FTP Through an HTTP Proxy Has Two Different Modes
Separate an HTTP gateway fetching an FTP URL from curl speaking FTP through CONNECT tunnels.
An FTP URL behind an HTTP proxy can use either of these arrangements:
| Mode | What curl sends |
|---|---|
| HTTP FTP gateway | An HTTP request asking the proxy to retrieve the FTP resource. |
| CONNECT tunneling | A tunnel request, followed by native FTP protocol bytes through the accepted connection. |
This command uses the gateway arrangement:
curl --proxy http://203.0.113.10:8080 \
ftp://files.example.com/report.txtReplace the documentation endpoint and file destination. As the curl HTTP-proxy documentation explains, curl speaks HTTP to the proxy in that mode. A successful file fetch does not establish every FTP-specific operation.
Add --proxytunnel when the service is intended to carry native FTP through CONNECT. It must permit the necessary target connections. FTP has separate control and data connections, so passive addresses/ports, CONNECT rules and server configuration can break a transfer after login succeeds.
Keep the failed stage: CONNECT rejection, FTP login failure or passive data failure. Service-specific gateways that encode another destination into USER/PASS use their own login conventions; those are neither ordinary HTTP proxy credentials nor SOCKS negotiation.
Use the documented proxy mode and file service security configuration. A tunnel alone does not encrypt plaintext FTP credentials or file data.