FTP Port Protocol Type

Question

I recently switched to a different VPN provider, therefore did a fresh server installation. Before I proceed, please keep in mind that I am not super experienced with server stuff.

I am having a problem with my FTP server installation. Even though I think this is not relevant with what FTP server I am using (because I had the same error on both Windows Server FTP Services and FileZilla), I am currently using Windows Server FTP. I was getting "Failed to retrieve directory listing" message. In my research, I have found this has to do with the port opening.

Anyway, I got it working by changing some settings in the port that I have opened (21) but my real question is;

The previous (not working) FTP port rule was Protocol Type: TCP. Now that I have set it to Protocol Type: Any it works perfectly. But I am not sure if that would cause a security issue... I have tried each option in the combo box but none of them even let me connect... But when I select the Any option, it works. So, the question is; is it safe to use Any option for the protocol type?

Thank you!

IMAGE: My FTP Rule on the server

Answer 1

No, it is not safe to configure your firewall as you indicated. Using a firewall configured using the rule in the image you linked would be a security risk because that rule effectively opens up ALL ports and all protocols.

The reason your port 21 rule was not working was because FTP actually requires 2 channels to function, a command channel and a data channel. The command channel is typically established on port 21 and the way the data channel is created depends on whether you are running in active or passive mode.

For a description of each, please see this Stack Overflow post: https://stackoverflow.com/questions/1699145/what-is-the-difference-between-active-and-passive-ftp

I am going to assume you are operating in passive mode since changing your firewall rule wouldn't have fixed an active mode problem since that would more likely be on the client side firewall. Therefore, my recommendation would be to limit the port range for passive mode on your server, and then open up that range of ports on the firewall in addition to TCP 21. Instructions for configuring a Windows Server for Passive FTP can be found at the following link:

https://technet.microsoft.com/en-us/library/dd421710(v=ws.10).aspx

Generally, you want to have enough passive mode ports available to service your peak concurrent client connections as each port services a single passive mode data connection.