Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've openened these ports

20 
21 
990 
49152 - 50300 

But it doesnt work.

As soon as I turn off the Firewall it works.

Which ports need more to be open for FileZilla ftp?

share|improve this question
    
Is your server behind a dedicated firewall? If so, just turn it off in Windows. –  DanBig Feb 1 '12 at 16:19
    
Yes but I would like it to work with targeting the specific ports –  Chris_45 Feb 1 '12 at 16:20
    
Are you trying to do active or passive ftp? And I'm assuming you're talking about for incoming connections but if you could clarify if this is for incoming or outgoing that would also help. –  squillman Feb 1 '12 at 16:34
    
Trying active ftp, yes incoming –  Chris_45 Feb 1 '12 at 16:43
    
Check the windows firewall log, assuming you are logging dropped packets. It will show which port is being accessed and denied. –  Tatas Feb 1 '12 at 17:39
add comment

1 Answer 1

The issue here is that FTP is a flawed protocol in today's world of opening specific ports for specific purposes.

With "active mode" FTP, the FTP client initiates a connection to the server on TCP port 21, therefor you need to allow incoming traffic on TCP/21. After this connection is established, the client can provide the server with an IP address and port number to connect back to the client on. There are many flaws with this:

  • You need to allow outbound traffic on any port from this system to wherever the client is (generally in a decently secure environment this is awful).
  • The client needs to allow incoming connections on whatever port it's requested the connection back on. Most clients will choose a random high number port, then become very upset to find out that their Linksys router is performing Stateful Packet Inspection and denying the data connection.

"Passive mode" FTP addresses some of these concerns by having only client-initiated connections. The client requests an IP and Port to use for data transmission by specifying the PASV command. In this mode, your server needs to allow incoming connections on whatever ports it will allocate for passive data transfer.

Overall, I'd recommend against using FTP if at all possible for the complexity of the above as well as the fact that everything is sent in clear text.

share|improve this answer
    
Ok I guess you recommend SFTP. –  Chris_45 Feb 2 '12 at 12:31
    
SFTP/SCP is far more secure, and definitely more sane. :) –  Kyle Smith Feb 2 '12 at 14:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.