Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I thought if I opened ports 20 and 21 it would work. Instead I'm able to connect and change directories but whenI try a 'dir' for example, I get "Could not open data connection to port XXXXX" with the port number varying. If I just turn off the firewall everything works fine. Is there some massive port range I have to allow for this to work?

share|improve this question
    
Are you using active or passive ftp mode? –  Wesley Apr 20 '12 at 19:04
    
Command line FTP does not support passive mode on Windows. That is the problem... –  Glenn Sullivan Apr 20 '12 at 19:05
    
@GlennSullivan Ahhh, right. So who gets to break the news to him with an answer below? =) –  Wesley Apr 20 '12 at 19:07
    
Beat you too it... –  Glenn Sullivan Apr 20 '12 at 19:08
add comment

1 Answer

up vote 2 down vote accepted

When creating the FTP site in IIS you have the choice of which dynamic ports to use. Whatever ports are set there need to be open in the firewall.

Or, you need to use an FTP client that supports PASV mode, which forces all transfers over the FTP port. But the command line from Microsoft does not support that.

The other option that you have would be to enable Stateful FTP inspection of the firewall. After opening the FTP (21) port, issue the following command on the server at the command line:

netsh advfirewall set global StatefulFtp enable

I believe that only works on Vista, Windows 7, and 2K8 "servers."

share|improve this answer
    
For those interested, sending quote pasv to the server from the Windows ftp.exe command will tell the server to go into passive mode, but has no bearing on the client. –  Wesley Apr 20 '12 at 19:10
    
More info added about Stateful FTP setting on Windows Firewall... –  Glenn Sullivan Apr 20 '12 at 19:13
    
Thanks for the infos. This was part of a database backup batch file that would put the dump file on an ftp server which was why I was using the command line ftp. would it be stupid of me to turn off the firewall, do the ftp, then turn the firewall back on in the batch file? –  Jeff Apr 26 '12 at 13:29
    
I would not suggest it... that command should only need to be run once (unless you disable StatefulFtp with an equivalent disable command) so you should be able to just run it once and it should work. If you are worried about it being disabled, add the line above to the batch file that calls your FTP. –  Glenn Sullivan Apr 27 '12 at 15:07
    
...unless the problem is you can't use that command because you have the wrong OS... –  Glenn Sullivan Apr 27 '12 at 15:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.