Date:        Sun, 2 Jan 2005 16:53:52 +0000
    From:        Richard Ibbotson <richard@sheflug.co.uk>
    Message-ID:  <200501021653.52585.richard@sheflug.co.uk>

  | > The ftp(1) program uses passive ftp by default.
  | 
  | Hmmm.....
  | 
  | pkg_add 
  | ftp://ftp.netbsd.org/pub/NetBSD/packages/2.0/i386/All/bash-2.05.2.7nb2.tgz
  | 
  | "ftp: connect to address 2001:4f8:4:7:2e0:81ff:fe21:6563: No route to 
  | host."

This has absolutely nothing to do with active/passive FTP.   That difference
matters when the client has connected to the server, and is making
a data connection to transfer the file.   If FTP never connects at all, it
never has an opportunity to make active/passive distinctions.

  | All other packets are routed without problem.  Maybe I need to open a 
  | port for pkg_add ?  Although, I thought it was working on port 21 
  | anyway.  ftp and all other protocols work fine through the firewall.  
  | Maybe I need to do some sort of debugging ?

Maybe you should consider what you're going with IPv6 ?

The address it is failing to connect to is a v6 address - it would only
be trying that if your system believes that you have v6 connectivity.
Clearly you don't ("no route to host" isn't coming from a firewall, it
is from your routing tables - you don't have an IPv6 default route).

The more interesting thing here is what happens next?   if a v6 connection
to the server fails, it should simply fall back and try v4 instead.

Does it not do that?

kre