Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite
1

On a Windows Server 2008 R2 Web server, I have a Windows Service which uploads files to an external FTP server. Actually multiple servers (Google, Bing, etc.). This is a .NET application which uses the built-in .NET FTP libraries.

I'm getting a mixture of the following errors:

The operation has timed out.
The remote server returned an error: (425) Can't open data connection.

Windows Firewall (Domain, Private, Public) is set to allow outbound connections.

share|improve this question
As a troubleshooting step, try the same FTP operation from the command line. If it succeeds, you can suspect your code/service as the problem. If it fails, you can rule out your code/service as the problem. You might also try running a packet capture while running the service to see if the capture gives you any clues. – joeqwerty Jun 21 '11 at 2:40
Yep, I did do that and connecting works fine but sending the data does not (as explained in @sysadmin's answer). Thanks. – Josh M. Jun 21 '11 at 11:37

1 Answer

up vote 2 down vote accepted

FTP is not a firewall-friendly protocol. It predates the Internet era where firewalls were common, so assumes it's perfectly oK for both sides of a conversation to open ports with each other. The COMMAND channel, which is what you open when you connect to an FTP server, is a connection you initiate between you and the server. The DATA channel, what you use to download stuff, is a connection initiated by the FTP Server to you. What's worse, the port your FTP chooses to present is a random high port so configuring your firewall to allow the right ports is tricky.

This is why they created "Passive" mode in the FTP protocol. This is the PASV verb. This tells the FTP server to reverse the initiation direction of the DATA channel; it gives the client the high port to connect to, the client initiates the connection, and the server feeds data over that connection. Much easier to firewall.

For .NET's libraries, you'll probably get better luck setting the UsePassive property to True.

share|improve this answer
Right. I had specifically disabled passive mode for these connections because I was getting strange issues with that. I'll try to re-enable it and see if I can work out that issue instead. Thanks. – Josh M. Jun 21 '11 at 11:36
Passive mode is working out fine now. Silly of me to not realize that was the problem - thanks for the info. – Josh M. Jun 21 '11 at 14:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.