As the title states, I currently have an FTP server accessible via FTP or FTPS (explicit) running NATed behind a router. The server is running Windows Server 2012 R2 with IIS 8.0 (I believe that is the version that ships with 2012r2).

The server will only be used by a handful of people, less than 10.

The server is currently functioning as it should, with ports 21 and 30850-30859 (data channel) forwarded from the router. My question is, how many data channel ports are necessary for FTPS? Is one per simultaneous file transfer? Or simultaneous user? Or...?

1 Answer 1


You need enough data ports so that client IP - client random port - server data port combination uniquely identifies any FTP session (transfer).

The port number serves as a link between a transfer request on the control connection and a data connection. Note that there's no "protocol" on the data connection, that could be used by the client to tell, what it asks for. The port number is the only unique information the server has.

How strong the uniqueness has to be probably depends on the server implementation. I believe most servers require the port to be unique only for that short moment after the client asks for the transfer and before it connects to the data port. So if you have 10 ports and 11 clients asks for a transfer at the very same moment, the 11th is likely to get rejected.

If two clients were to request transfer at the same time, and the server would use the same port number for both (not having any other spare), the server would not be able to tell, what file to transfer. Of course, the server could use a client IP for the decision (actually many FTP servers do validate that the client IP matches the IP used on the control connection for security).

But real life implementations open an unique listening socket, when the client requests the transfer. So when there's no port number free, the server fails to start listening, rejects the transfer, hence it does not even get to having the above problem.

On the other hand, the FTP server built into Bitvise "SSH" server actually supports a single data port only. The server requires a TLS encryption and a session resumption. It uses the TLS session to link the control and data connections.

See also Why does FTP passive mode require a port range as opposed to only one port?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.