Member Avatar for nissiinfotech

In our office we have nearly 45 staff.. They all know the different domain ftp password they use to upload and download the files by them self. it has been misused. Now we want to restrict the ftp access from outside the office.

We have shared hosting where we can't give IP restriction in the server. So we need a solution where our staff can't access our server through FTP from outside the company.

I need a solution like with local user name and password it should connect the local server and in that server it should recognize the correct domain and connect the server and upload and download the files. ( In the local server already the original user name and password must be entered )

I need a software which works like this.

Lan ftp <----> Local FTP server<----> Wan ftp

lan ftp should have different user name and password wan ftp should have different user name and password for the same domain.

Is there any solution for ftp works like proxy+ mail?

Thank you in advance...

  • 4 Contributors
  • 3 Replies
  • 206 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by jbennet

Dani AI

Generated

A practical, low‑risk design is to remove direct WAN FTP access from every workstation and funnel all file transfers through a single LAN gateway or a VPN. This matches the requested topology (LAN FTP ⇄ Local gateway ⇄ WAN FTP) and keeps each staff member authenticating only to an internal account while the gateway holds and uses the shared domain credentials. As suggested, prefer encrypted transports (SFTP or FTPS) when the host supports them; as noted, firewall rules are essential; and ’s request for server details is relevant because exact steps depend on the OS and hosting capabilities.

Concrete implementation notes:

  • Install a small trusted server on the LAN as the “FTP gateway.” Run an internal SFTP/FTPS/FTP service for staff logins (local accounts or LDAP). The gateway stores per‑site remote credentials in a protected configuration (strict file permissions, limited admin access).
  • Automate forwarding: on upload to the gateway, use a push script (or an inotify/cron job) that connects to the remote host and transfers the files. Common tools for this task include scripted SFTP/SCP or an FTP client that supports scripted mirrors.
  • Network controls: on the office router/firewall block outbound FTP (TCP 21 and passive port range) from all workstation IPs, and allow outbound FTP only from the gateway’s IP. That enforces use of the gateway even though the shared host cannot do IP whitelisting.

Security and operational cautions:

  • Central credential storage is a single point of compromise: enforce strict OS permissions, use key‑based auth where possible, rotate remote passwords regularly, and keep the gateway patched and audited.
  • Prefer SFTP/FTPS to avoid plaintext passwords; if the host won’t support them, the gateway still protects credentials by preventing direct remote usage and provides an audit trail of who uploaded what.
  • Log transfers, test passive/active FTP behavior with the host, and validate end‑to‑end transfers before cutting off workstation access.

Checklist (short): deploy gateway; implement upload automation; block direct outbound FTP from workstations; enable encrypted transfers if available; secure and audit the gateway; rotate credentials.

Recommended Answers

All 3 Replies

Member Avatar for fsn812

I'm not a networking guy, but can't this be done through a router on the WAN -> Local level? Perhaps looking into a firewall might help.

Member Avatar for DimaYasny

more info - what server, how the users authenticate etc

Member Avatar for jbennet

Sftp

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.