I thought if I opened ports 20 and 21 it would work. Instead I'm able to connect and change directories but whenI try a 'dir' for example, I get "Could not open data connection to port XXXXX" with the port number varying. If I just turn off the firewall everything works fine. Is there some massive port range I have to allow for this to work?

  • Are you using active or passive ftp mode? – Wesley Apr 20 '12 at 19:04
  • Command line FTP does not support passive mode on Windows. That is the problem... – Glenn Sullivan Apr 20 '12 at 19:05
  • @GlennSullivan Ahhh, right. So who gets to break the news to him with an answer below? =) – Wesley Apr 20 '12 at 19:07
  • Beat you too it... – Glenn Sullivan Apr 20 '12 at 19:08

When creating the FTP site in IIS you have the choice of which dynamic ports to use. Whatever ports are set there need to be open in the firewall.

Or, you need to use an FTP client that supports PASV mode, which forces all transfers over the FTP port. But the command line from Microsoft does not support that.

The other option that you have would be to enable Stateful FTP inspection of the firewall. After opening the FTP (21) port, issue the following command on the server at the command line:

netsh advfirewall set global StatefulFtp enable

I believe that only works on Vista, Windows 7, and 2K8 "servers."

  • For those interested, sending quote pasv to the server from the Windows ftp.exe command will tell the server to go into passive mode, but has no bearing on the client. – Wesley Apr 20 '12 at 19:10
  • More info added about Stateful FTP setting on Windows Firewall... – Glenn Sullivan Apr 20 '12 at 19:13
  • Thanks for the infos. This was part of a database backup batch file that would put the dump file on an ftp server which was why I was using the command line ftp. would it be stupid of me to turn off the firewall, do the ftp, then turn the firewall back on in the batch file? – Jeff Apr 26 '12 at 13:29
  • I would not suggest it... that command should only need to be run once (unless you disable StatefulFtp with an equivalent disable command) so you should be able to just run it once and it should work. If you are worried about it being disabled, add the line above to the batch file that calls your FTP. – Glenn Sullivan Apr 27 '12 at 15:07
  • ...unless the problem is you can't use that command because you have the wrong OS... – Glenn Sullivan Apr 27 '12 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.