I configured FTP Service/Role on my Windows Server 2008 R2 machine. I am able to connect from the inside, but not from the outside. On the inside I tested using cmd prompt and IE FTP. On the outside, I am testing with FileZilla and IE FTP. From the outside, IE FTP prompts me to enter my username/pwd, but nothing happens. Page eventually times out and I get "Internet Explorer cannot display page". Using FileZilla, I get the following messages. Note FileZilla resolved domain name and authenticates. I did not configure FTP Wirewall Support on the FTP site. I am not sure if I need to do this. I set up basic authentication, non-ssl, not allowing anonymous. I testing with Windows Firewall Turned off and on (I added windows firewall rule for port 21). On my network firewall (Cisco), I added a rule to forward port 21 traffic to FTP Server.

Status: Resolving address of ftp.technologyblends.com
Status: Connecting to
Status: Connection established, waiting for welcome message...
Response: 220 Microsoft FTP Service
Command: USER *
Response: 331 Password required for *
Command: PASS ********
Response: 230 User logged in.
Command: SYST
Response: 215 Windows_NT
Command: FEAT
Response: 211-Extended features supported:
Response: LANG EN*
Response: UTF8
Response: PBSZ
Response: PROT C;P;
Response: CCC
Response: HOST
Response: SIZE
Response: MDTM
Response: 211 END
Command: OPTS UTF8 ON
Response: 200 OPTS UTF8 command successful - UTF8 encoding now ON.
Status: Connected
Status: Retrieving directory listing...
Command: PWD
Response: 257 "/" is current directory.
Command: TYPE I
Response: 200 Type set to I.
Command: PASV
Error: Connection timed out
Error: Failed to retrieve directory listing

2 Answers 2


Try to set your connection to ACTIVE MODE instead of PASV

  • Nothing seems to work. At this point I am not sure if its on my Network Firewall or something on my FTP Server. While inside the network FTP is working as expected. I just cannot get it to work from the outside. Not sure how to troubleshoot where the problem may be. Thanks for any tips.
    – obautista
    Jan 31, 2011 at 13:00
  • just for your consideration and this only as a comparative scenario, have you considered installing filezilla server instead of using MS ftp?
    – redknight
    Feb 1, 2011 at 19:36

I understand you have NAT going on and the server has a private address. The most likely cause is you not letting the ephemeral ports through. I think that if you just made a DMZ and let everything through, it would start working. But that's insecure. The better way is to find a way to limit the range of passive ports used and forward that range to your server. Here are some instructions: https://manage.accuwebhosting.com/knowledgebase/2334/How-to-Configure-Passive-Port-Range-for-the-FTP-Service-in-IIS.html . Then forward that same range on the NATing router to the internal IP of your server. The tutorial linked shows 6001-6001, but I recommend that you do something like 60000-61000. The reason being that the "lower" numbers in the thousands get used by other traffic a lot whereas the higher ones tend to remain quiet.

That said, the FTP shim in the NAT should create that port mapping automatically as a RELATED connection. Check if you don't have them blocked in the firewall and if the FTP shim is even loaded. On Linux, it could be called ip_conntrack, nf_conntrack, nf_conntrack_ftp or nf_conntrack_proto_ftp depending on the version. It may be even compiled monolithically in which case you won't see it among the modules, but it will still work.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .