I have two machines behind the same firewall/router - one is a Windows 7 workstation and the other is a Windows 2003 server. The problem is with outgoing FTP access using the FileZilla FTP client (note: not server) on the Windows 2003 server.
Using FileZilla client on the Win7 workstation I am able to connect to an external FTP site using passive mode without issue. However, when I try the same thing from FileZilla client on the Windows 2003 server it hangs when attempting to retrieve the directory list. The log output is as follows:
Status: Resolving address of xxxxx.com Status: Connecting to xxx.xxx.xxx.xxx:21... Status: Connection established, waiting for welcome message... Response: 220---------- Welcome to ... Command: USER ... Response: 331 User ... OK. Password required Command: PASS ************* Response: 230 OK. Current directory is / Command: SYST Response: 215 UNIX Type: L8 Command: FEAT Response: 211-Extensions supported: Response: EPRT Response: IDLE Response: MDTM Response: SIZE Response: REST STREAM Response: MLST type*;size*;sizd*;modify*;UNIX.mode*;UNIX.uid*;UNIX.gid*;unique*; Response: MLSD Response: ESTP Response: PASV Response: EPSV Response: SPSV Response: 211 End. Status: Connected Status: Retrieving directory listing... Command: PWD Response: 257 "/" is your current location Command: TYPE I Response: 200 TYPE is now 8-bit binary Command: PASV Response: 227 Entering Passive Mode (xxx,xxx,xxx,xxx,164,24) Command: MLSD Error: Connection timed out Error: Failed to retrieve directory listing
As you can see, a connection over port 21 is established and a request to enter passive mode results in port 42008 being established. But the attempt to retrieve data over that port fails. This works flawlessly on the Win7 machine.
I understand passive vs. active mode fairly well. It appears in this case that Windows Server 2003 is blocking traffic on certain ports. The Windows Firewall service isn't running on this device so I can eliminate that as the culprit. I would appreciate any other suggestions on how to track this down.
UPDATE Turns out that it's specific to one FTP site. I can connect to another site using passive mode just fine. The difference appears to be port number. The passive port number on the site I can reach is 4693. The passive port number on the site that I can't reach is over 42000. Does this have any bearing on the situation?
UPDATE I wrote a little socket server program running on the Win7 workstation that listened on port 50000, then from the Windows 2003 box I ran telnet to the address/port of the workstation and...it worked. So within the LAN Windows 2003 is allowing the traffic. Somehow it's not allowing the traffic out over the Internet. Baffling.
UPDATE Problem was with FTP server. See answer below.