Port forwarding for an FTP server in passive mode

docs/administrator-manual/firewall/port_forward.md

@@ -31,6 +31,42 @@ For each port forward the user can also configure the following aspects:
 - **Access restriction**: Port forwards can be restricted to specific sources to enhance security. This can be done using the `Restrict access to` field. The field accepts IP addresses, CIDR blocks or an object. All objects are supported, except host sets containing IP ranges or nested objects.
 - **Enabling logging**: port forwards can be configured to log incoming traffic for each rule. By enabling the `Log` option, the network administrator can keep track of the traffic passing through the port forward, allowing for monitoring and analysis. By default, logging is limited to 1 entry per second. To change this limit, refer to the [Logging limits](./firewall_rules.md#logging-limits) section.
 
+## Port forwarding for an FTP server in passive mode {#port_forward_ftp-section}
+
+When creating a port forward for TCP port `21` to publish an FTP server located inside the LAN, passive FTP connections may not work correctly with the default configuration.
+Passive FTP uses additional dynamically negotiated ports for data connections: to allow NethSecurity 8 to identify these related connections and apply NAT correctly, the Netfilter FTP connection tracking helper must be enabled on the WAN zone.
+
+### Configuration
+
+#### 1. Load the FTP helper modules
+
+From the **NAT helpers** page in the web interface, enable the following kernel modules:
+
+```text
+nf_conntrack_ftp
+nf_nat_ftp
+```
+
+#### 2. Enable the FTP helper on the WAN zone
+
+Connect to the firewall through SSH and run:
+
+```bash
+uci set firewall.ns_wan.auto_helper='0'
+uci set firewall.ns_wan.helper='ftp'
+uci commit firewall
+reload_config
+```
+
+This configuration disables automatic helper assignment and explicitly enables the FTP helper on the `ns_wan` zone.
+
+:::warning
+
+If the firewall was migrated from NethServer 7, step 1 is not required because the FTP helper modules are already enabled by default for backward compatibility.
+However, step 2 is still required: the FTP helper must be explicitly assigned to the `ns_wan` zone also on migrated systems.
+
+:::
+
 ## Hairpin NAT {#hairpin-section}
 
 Hairpin NAT, also known as NAT loopback or NAT reflection, is a technique used in networking where internal hosts access a server located within the same local network using the external IP address of the router or firewall. In other words, when internal devices attempt to connect to a server using the public IP address, hairpin NAT ensures that the traffic is routed internally without going out to the internet and then back into the local network.

docs/administrator-manual/migration.md

@@ -140,7 +140,7 @@ After the changes, devices use shorter names (e.g., `b0`, `b0.20`), compatible w
 | DHCP servers and reservations | Migrated with limits | DHCP servers on bond interfaces are not supported. |
 | DNS configuration and local hosts | Migrated with limits | TFTP options are migrated, but TFTP content is not. Configure `tftp_root` manually to re-enable it. |
 | Static IPv4 routes | Migrated | |
-| Port forwards | Migrated | |
+| Port forwards | Migrated | If you use port forwarding for an FTP server, you must explicitly enable the FTP conntrack helper on the WAN zone. See [Port Forward](./firewall/port_forward.md) for details. |
 | Firewall zones | Migrated | Green → `lan`, red → `wan`, orange → `dmz`, blue → `guest`. If a blue zone existed, DNS and DHCP accept rules are added automatically. |
 | Firewall rules | Migrated with conversion | Rules using NDPI services are not supported. Source/destination objects are converted to IP/CIDR values. NAT helpers are loaded automatically. |
 | Firewall objects | Not recreated | Objects cannot be reimported automatically. Rules that used objects are converted to the corresponding IP/CIDR values. |