up vote 2 down vote favorite
share [g+] share [fb]

What ports do I need to open for me to be able to access Windows FTP server (running on Server 2008) for both active and passive FTP? Opening 21 on it's own is not enough.

link|improve this question
69% accept rate
feedback

4 Answers

up vote 4 down vote accepted

Depends on if you're using Active or Passive ftp. Here's the chart from this site which has a great explanation of the differences from a port perspective:

 Active FTP :
     command : client >1023 -> server 21
     data    : client >1023 <- server 20

 Passive FTP :
     command : client >1023 -> server 21
     data    : client >1023 -> server >1023

So:

  • Active FTP - the firewall must allow incoming connections on TCP/21 and outgoing connections on TCP>1023.
  • Passive FTP - the firewall must allow incoming connections on TCP/21 and TCP>1023

If you're going to use Passive ftp the best thing to do is to configure the ftp server to use a specific (limited) port range for the client to connect to for the data stream and then open that range on the firewall.

link|improve this answer
So 20, 21 and 1023 will do it? All TCP? – Mr. Flibble Sep 16 '09 at 15:38
2  
20 and 21 are fixed for Active FTP. The other's are random ports greater than 1023. – squillman Sep 16 '09 at 15:47
Perfect, thanks. – Mr. Flibble Sep 16 '09 at 15:52
The random part is important. Most modern firewalls have special features specifically designed to handle active FTP connections. – senfo Sep 16 '09 at 15:53
feedback
up vote 0 down vote

If you used a real firewall, it would be able look at the PASV command inside the FTP control channel (TCP/21) and open the data port accordingly. Therefor, you only need to open TCP/21 and the firewall takes care of the rest.

Of course, the usual SOHO routers (and software FWs) won't do this for you. In this case you should stick with a defined port range (~3 ports per concurrent user) like squillman recommended.

link|improve this answer
feedback
up vote 0 down vote

I have a similar problem, i am hosting my ftp server on server 2008, i have opened 21,20. That strange thing is, i can access the ftp folder from command prompt, but i cannt browse them with windows explorer. When i disable the firewall on the server, everything works fine, so i know the firewall is blocking something, but i cannot figure out what else i need to open.

thanks

link|improve this answer
On Server 2008 R2 you have to restart the "Microsoft FTP" service before the changes take place. Restarting from IIS Manager is not sufficient. See this guide for more details: technet.microsoft.com/en-us/library/dd421710(WS.10).aspx – Greg Bray Nov 17 '10 at 23:17
feedback
up vote 0 down vote

I have a similar strange problem that all the ports (21, 20, and 5500 for pasv) are open in windows firewall (server 2003) yet telnet proves that even 21 is blocked when the firewall is on. Everything works fine whenever the firewall is off. And on top of that, there are certain times of the day (totally random) when it works regardless. Until it doesn't. And when it doesn't, turning off windows firewall fixes it. It's not the FTP server, that's not even logging an attempt to connect.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.