I have two machines behind the same firewall/router - one is a Windows 7 workstation and the other is a Windows 2003 server. The problem is with outgoing FTP access using the FileZilla FTP client (note: not server) on the Windows 2003 server.
Using FileZilla client on the Win7 workstation I am able to connect to an external FTP site using passive mode without issue. However, when I try the same thing from FileZilla client on the Windows 2003 server it hangs when attempting to retrieve the directory list. The log output is as follows:
Status: Resolving address of xxxxx.com
Status: Connecting to xxx.xxx.xxx.xxx:21...
Status: Connection established, waiting for welcome message...
Response: 220---------- Welcome to ...
Command: USER ...
Response: 331 User ... OK. Password required
Command: PASS *************
Response: 230 OK. Current directory is /
Command: SYST
Response: 215 UNIX Type: L8
Command: FEAT
Response: 211-Extensions supported:
Response: EPRT
Response: IDLE
Response: MDTM
Response: SIZE
Response: REST STREAM
Response: MLST type*;size*;sizd*;modify*;UNIX.mode*;UNIX.uid*;UNIX.gid*;unique*;
Response: MLSD
Response: ESTP
Response: PASV
Response: EPSV
Response: SPSV
Response: 211 End.
Status: Connected
Status: Retrieving directory listing...
Command: PWD
Response: 257 "/" is your current location
Command: TYPE I
Response: 200 TYPE is now 8-bit binary
Command: PASV
Response: 227 Entering Passive Mode (xxx,xxx,xxx,xxx,164,24)
Command: MLSD
Error: Connection timed out
Error: Failed to retrieve directory listing
As you can see, a connection over port 21 is established and a request to enter passive mode results in port 42008 being established. But the attempt to retrieve data over that port fails. This works flawlessly on the Win7 machine.
I understand passive vs. active mode fairly well. It appears in this case that Windows Server 2003 is blocking traffic on certain ports. The Windows Firewall service isn't running on this device so I can eliminate that as the culprit. I would appreciate any other suggestions on how to track this down.
UPDATE Turns out that it's specific to one FTP site. I can connect to another site using passive mode just fine. The difference appears to be port number. The passive port number on the site I can reach is 4693. The passive port number on the site that I can't reach is over 42000. Does this have any bearing on the situation?
UPDATE I wrote a little socket server program running on the Win7 workstation that listened on port 50000, then from the Windows 2003 box I ran telnet to the address/port of the workstation and...it worked. So within the LAN Windows 2003 is allowing the traffic. Somehow it's not allowing the traffic out over the Internet. Baffling.
UPDATE Problem was with FTP server. See answer below.