Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just set up an FTP server using the latest version of FileZilla server. I set up a user and gave them a home directory. If I connect to the server via 127.0.0.1:21 or 192.168.1.42:21 (my local IP), files can be uploaded and downloaded, and everything works as it should. However, when I connect via my external domain name, www.suchipi.com:21, the server connects but directory listing fails. I thought this might be an error with how I set up my A Record, but connecting to my external IP via 75.70.128.37:21 results in the same problem. Port 21 is the only port forwarded. Do I need to further any other ports?

share|improve this question
    
What kind of firewall? –  SpacemanSpiff May 1 '12 at 21:02
add comment

4 Answers 4

up vote 2 down vote accepted

You also need to open port 20/TCP to allow the traffic for the data connection. This port will be used by the FTP client when configured to use passive mode.

share|improve this answer
    
And run the client in passive mode : en.wikipedia.org/wiki/File_Transfer_Protocol –  mfinni May 1 '12 at 15:57
    
Thanks, this in conjunction with a passive mode client resolved my problem. –  Suchipi May 2 '12 at 0:51
add comment

If your firewall has FTP protocol connection tracking, like ip_conntrack_ftp and ip_nat_ftp from netfilter, then you just need to load the proper module and/or specify that you are allowing the FTP protocol (not only port 21).

If the firewall does not support the FTP protocol, then the only option is to configure the FTP server to allow passive mode clients. For this you will need to allow TCP port 21 for control connection and TCP port 20 for data connection. Data connection is used for listing of the folders and for file transfers.

share|improve this answer
add comment

Do I need to further any other ports?

Yes, you need - and there is no static list. FTP has a VERY bad issue: in active mode, the server will connect TO (!) the client on a RANDOM (!) port. YOu need to get the port number from the command stream. Basically you say "List" and the server tries to open a TCP connection TO The client on a RANDOM port to SEND The list. OUCH.

This is why you can put the client into PASSIVE mode, which means all connections are opened from the client, but even then you will need to forward other port umbers.

Generally FTP comes from a time noone thought even of firewalls - and someone made the bad decision to ahve the server put in an active connection to the client.

This works a lot better if you do not PORT FORWARD but use a proper router / firewall that knows how to forward FTP (i.e. not just the TCP session, but handle the content of the TCP session and translate port numbers etc.). Pretty much every sensible firewall should be able to do so - even Linux ones, you just need to stay away from "stupid" tcp forwarding.

http://www.google.de/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&ved=0CDoQFjAB&url=http%3A%2F%2Fwww.linuxquestions.org%2Fquestions%2Flinux-security-4%2Fftp-publishing-need-help-configuring-iptables-in-passive-mode-in-non-standard-port-891483%2F&ei=AhOgT9mbI8eg4gS0n5XxAg&usg=AFQjCNE6yy7PObATNc0tDQoC2Co3RUFrUQ

has some explanations, also on possible issues- as you can see it is a pain in the butt to get that going.

In general, it is best to not use FTP in such a scenario, sorry to say.

share|improve this answer
    
TomTom, you missed port 20. He needs that one too, even in passive mode. –  mfinni May 1 '12 at 16:52
    
@mfinni, we got it, no need to spray the downvotes... –  Bart De Vos May 1 '12 at 17:23
    
Bart - no spraying at all. I downvoted yours because it's actually wrong. If the clients are only in passive mode, they don't need a high port range open, just 20 and 21. I did not downvote TomTom's; he didn't explicitly include 20, but he hinted at other ports needed even in passive mode, so I just added a comment. Plus, he's right in his final conclusion that FTP just isn't a great protocol to use behind dumb NAT. –  mfinni May 1 '12 at 18:44
add comment

Enable Passive Mode. Set them to a set port range (some random high-ports, 20000-22000 fe). Don't forget to open these ports on your firewall and forward them on your router together with port 20.

share|improve this answer
    
you missed port 20. He needs that one too, even in passive mode. –  mfinni May 1 '12 at 16:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.