Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a couple FTP servers setup which I am unable to access using a particular client machine. The client is a Windows 2012 server in my company's network over which I do not have admin rights. The client has WinSCP installed as its FTP client, and is unable to use either of the FTP servers I have setup. Other machines have no problem connecting to the FTP servers, so my problem is isolated to my Windows 2012 client.

The specific protocol I am using on the WinSCP client is FTP with either (1) no encryption, or (2) TLS explicit encryption. One of the FTP servers does not have any certificates installed, so to connect to that one requires no encryption (we will call this FTP server A). The other FTP server does have a certificate installed, so TLS Explicit encryption is required to connect to it (we will call this FTP server B).

When attempting to connect with the FTP client, the specific WinSCP error message just says "Access denied". I know that the client machine from which I am having issues establishing a FTP connection has a firewall configured, but I was told from my system admin that ports 20, 21, and 990 had been opened for allowing connections.

  • Are ports 20, 21, and 990 the ports required for utilizing FTP with either no encryption or TLS explicit encryption?
  • Is there a way that I can check these ports as a user to see whether or not they actually are open? I have heard that the TRACERT command might be useful, but I do not know how to use it to diagnose this particular problem.

I have admin rights to the FTP servers themselves, so perhaps I can monitor or reconfigure anything on that end to diagnose the problem. However, I think that would generally be a step in the wrong direction, since no other FTP clients are experiencing issues with either FTP server.

The FTP servers are both Windows 2008 R2 boxes with Filezilla as their FTP server software.

share|improve this question
are all the servers Windoze boxes? some? which? – mdpc Jun 6 '13 at 19:49
2008 R2 boxes, Filezilla software. I edited post to include. – nairware Jun 6 '13 at 19:55
You should test with netstat to see if the packets are actually leaving point a and arriving at point b first. This can rule out if there are any port blockages by your friendly neighborhood network/firewall czars. – Techie Joe Jun 11 '13 at 23:58
When I did netstat -np TCP | find "20", I was able to get two ESTABLISHED connections listed. When I tried the same command on 21, 22, and 990, I did not get any listings. I don't know if this was the right test or what these results mean either. I think it means 20 is open, but I don't know about the others. – nairware Jun 13 '13 at 17:04
In general "Access denied" means that connection was established, but authentication failed. So this has unlikely anything to do with firewall. Sharing a complete error message or even better a session log file or yet better server's log file log would be useful. – Martin Prikryl Jul 4 '13 at 6:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.