up vote 1 down vote favorite
1
share [g+] share [fb]

I have an application that runs as a service and contains an FTP client. It needs to connect to an FTP server that only supports Active FTP. When I attempt to get a list of files or download a file, Windows Firewall is dropping the incoming connection from the FTP server. (I don't believe we had this problem in Windows XP or Windows Vista.)

Active FTP is the protocol that requires the the server to open a connection to the client on a port that the client specified. (http://slacksite.com/other/ftp.html)

I know I could open up a large port range in Windows Firewall and force my FTP client to only use those ports, but I would have guessed that Windows Firewall would support Active FTP natively.

Is there some setting that needs to be made in order to have Windows Firewall automatically detect Active FTP and open up the necessary ports as needed? Can I change that setting programmatically?

Thanks.

PS- I asked this question on StackOverflow, but was told I should probably ask here as well.

link|improve this question
I know this seems like pass-the-buck, but this is actually better suited to superuser.com – Izzy Oct 27 '09 at 23:58
feedback

5 Answers

up vote 3 down vote

Here's the thing: Whether in Active or Passive mode, the server always uses port 20 on it's side for the data connection and connects to the client on whatever port the client specified when it issued the FTP PORT command.

After looking at the Windows 7 firewall it looks like you can create a custom inbound rule that allows connections to any local port from a specific remote port (20) for a given protocol type (TCP). You can also specify the local and remote ip addresses that this rule applies to.

I have to admit that I've never monkeyed around with the Windows firewall but it looks to me like it might work for you.

link|improve this answer
I have these rules implemented (the were already there), but I still can't connect. I think it is a network issue for me because I can send commands fine, but the data channel is trying to communicate with 192.168.1.145 for some reason, instead of the external FTP server... but vote up because your answer should still be applicable. – John Bubriski Sep 16 '11 at 18:27
feedback
up vote 2 down vote

Instead of adding ports to the Windows Firewall exception list, add the application you need to have access. Windows Firewall will then allow that application to bind and use whatever ports it wishes.

link|improve this answer
The problem is that the server is initiating the data connection on a random port to the client. The firewall will reject unsolicited inbound connections. – Izzy Oct 28 '09 at 2:25
1  
the connection is not really unsolicited. nor is the port random. The client picks the port and sends it to the server. Most non crappy firewalls that do connection tracking will see the port being sent to the server and allow the resulting connection. In the case of the windows firewall, since the client picks the port and binds the port, the application exception should allow the incoming connection. – Justin Jan 7 '10 at 4:30
FYI, I've tried this and it didn't work for me. I think there is something going on with my network because after trying a get command, the FTP client says PORT 192.168.1.145 which is obviously a local server... not sure why it's trying to do that though. But vote up because your answer should still be applicable. Maybe our network firewall is doing something? – John Bubriski Sep 16 '11 at 18:29
feedback
up vote 0 down vote

Have you tried making sure that your firewall is doing stateful FTP filtering?

You can do that by opening a command prompt with admin permissions and typing:

netsh advfirewall set global StatefulFtp enable

I'd be curious if that impacted your problem at all.

link|improve this answer
Can run "netsh advfirewall show global StatefulFtp" first to see the existing setting. It looks like its enabled by default. – fschwiet Oct 3 '10 at 1:38
Yeah, FYI, I tried this and no luck :( I'm not sure what the initial state what but it is enabled now. – John Bubriski Sep 16 '11 at 18:19
feedback
up vote 0 down vote

I would recommend running WinSSHD server instead. It has UPnP and will auto open the port 22 for you.

link|improve this answer
I don't have control of the FTP server. I'm trying to connect to a third party FTP server using my own application. My own application has to automatically deal with the local machine's own Windows Firewall as this is what most customers run out of the box. – Eli May 19 '10 at 17:02
I know that if you app is C# or VB.net that there is an API for controlling the local windows firewall ports. Maybe that is an option for you? – djangofan May 19 '10 at 17:17
feedback
up vote 0 down vote

I had the problem with an FTP client on our Intranet, and didn't want to make a firewall exception for that particular program. I wanted Active FTP to "Just Work", with any client program.

I tried to enable the "Application Layer Gateway Service" (sc start ALG), and made sure that I had "statefulftp" enabled (netsh advfirewall set global statefulftp enable). I suppose these are needed in some cases, but they didn't make a difference for me.

In the end, I just opend connections from port 20 from local IPs, and Active FTP works, with any program.

netsh advfirewall firewall add rule name="FTP (active)" action=allow protocol=TCP dir=in remoteport=20 remoteip=localsubnet

Instead of remoteip=localsubnet, you could also specify a particluar IP.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard