Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have configured my built-in Windows Firewall (Windows XP SP3) to allow this box to serve as a local FTP server (FileZilla server). The configuration was working until <insert some recent date>.

Specifically, I had configured these exceptions on the Windows Firewall -> Exceptions tab:

File Transfer Program (C:\WINDOWS\system32\ftp.exe) scope of "Any computer"

FileZilla (C:\Program Files\FileZilla\FileZilla.exe) scope of "My network (subnet) only"

ftp-data01 (Port number: TCP 2001) scope of "My network (subnet) only"
  . . . similar rules down to port 2010

As mentioned, this configuration was working until recently. If I look at the Windows Firewall Security Logging, I can see that the TCP SYN packets from my client to this server's port 21 are being dropped.

How should I configure Windows Firewall to allow the packets?

One solution that works is to use the "Advanced" tab -> "Local Area Connection" settings and enable "FTP Server", but the dialog box states that opens the exception for Internet access. I am looking for a solution that allows access for only the local subnet.

share|improve this question
add comment

2 Answers

What happened on May 23? Are you running antivirus which has a built-in firewall? I've had cases where I enabled an exception in the Windows firewall and not realized my AV's firewall was also blocking.

share|improve this answer
    
When something happens, look for something else that happened the same day. It's usually related. +1 –  Orihara May 28 '09 at 3:13
    
good point. I incorporated the suggestion into my findings. You inspired me to investigate further, and May 23 coincided with a change to my Anti-Spyware config. Unfortunately, that knowledge didn't help up. –  pcapademic May 28 '09 at 7:50
add comment
up vote 0 down vote accepted

First, try to figure out what happened on the date in question. Did your system install an update? Did you change the configuration of some other security related application, such as an Anti-Virus or Anti-Spyware application? Did something change your network configuration? Did you install a VPN or SSL-VPN client which may have affected your systems internal routing tables?

If you can figure out what changed, try and see if you can undo the change. Just be warned, undoing may not be possible for a variety of reasons. For the case that raised this question, it a change to the anti-spyware application coincided with the break in FTP service, but it was not possible to restore functionality by restoring the anti-spyware application configuration.

One solution is, on the Windows Firewall Exceptions tab, create an exception for Port 21 TCP and then scope the exception for "My network (subnet) only. Essentially, one is duplicating the functionality from the "Advanced Tab", but the Exceptions tab allows for the limit of scope.

This exception allows one to delete the "FileZilla" application exception and still permit access to the ftp server. The File Transfer Program exception is a red herring - that entry allows the ftp client on the server to access ftp servers on other hosts. The next time one tries to use the ftp client, Windows Firewall will pop-up a dialog box to create the exception, assuming a default configuration of Windows Firewall.

share|improve this answer
    
I incorporated K. Brian Kelley's suggesion along with my own findings. I welcome anyone's input on the matter. –  pcapademic May 31 '09 at 4:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.