I have an IIS which has some FTP sites hosted which use multiple port numbers for FTP. Some of the client computers connect to this FTP server in a specific port, say one FTP site would be using port 21, another one may be 2025. The client use FTP client like Filezilla to connect and it use PASV mode to connect. Now that the entire system is in AWS, I dont want to expose ports 1024 - 65535 to entire public internet, which PASV mode will connect. I restricted this ports and tried manually connecting with Filezilla to this FTP server using Active mode, which I fail. As this is a security vulnerability, I dont want to open all these ports to public. And since my clients doesnt have static IP, opening the ports to specific IP is also impossible.
I think I would need a way to connect either using Active mode which will establish connection and data port as same or any other permanent solution. Also, my another requirement around the same use case is that its better if I can expose only one port like FTP, and then based on the credential or the path being accessed, internally the requests go to relevant FTP sites or ports or use SFTP protocol which is also not supporting (I mean unable to connect) at the moment. Not sure whether both of these are acheivable. Any help would really be appreciated.