0

My customer give me some FTP credentials. From home, I can connect using FileZilla without problems. But from my EC2 instance can't connect. I try give permission to FileZilla in windows Firewall, disable Firewall and still nothing. I also try creating a fresh install and nothing.

Command:    PWD
Response:   257 "/" is current directory.
Command:    TYPE I
Response:   200 Type set to I
Command:    PASV
Response:   421 Could not create socket.
Command:    PORT 172,31,30,233,195,203
Response:   200 Port command successful
Command:    MLSD
Response:   150 Opening data channel for directory listing of "/"
Response:   425 Can't open data connection for transfer of "/"
Error:  Failed to retrieve directory listing
Status: Connection closed by server

I also check my security groups on the amazon console and the outgoing packages doesn't have restriction. The incoming packages has open port 20 and 21

1

You can connect and login on the default FTP port (TCP 21) but can't establish the second TCP connection, the data connection, that is required for passive FTP data transfers (and a directory listing is a data transfer).

The PORT response typically contains 6 octets that encode the server address the passive data connection needs to be made to.
eg PORT h1,h2,h3,h4,p1,p2 where h1.h2.h3.h4 is the server's IPv4 IP-address (172.31.30.233) and the TCP port number is (p1*256) + p2 i.e. xxx,x,xxx,xxx,195,203 represents port (195 * 256) + 203 = 50123

Your connection might fail because the PORT number advertised by the server does not start with a public routeable IPv4 addresss but a private use address ( 172.31.30.233 is from 172.16.0.0/12 range) or egress traffic to the port number used for passive traffic TCP 50123 in this case is blocked.

  • Ok but what I do? If I understand correct there are close port in my Amazon EC2 don't allow the second tcp connection? How I know which one are needed? What info should I ask my customer ? And that sound consistent on why I can connect from home. Because my firewall doesnt have those port close? But must be the security group of Amazon because I try turn off the windows firewall. – Juan Carlos Oropeza Oct 7 at 22:43
  • You may have restricted egress traffic in your security groups, check if they allow traffic to any/all ports on the FTP server you're connecting to (or contact the operator of the FTP server and request the range of ports they assign to passive FTP in addition to TCP 21 to make your security group more specific) – HBruijn Oct 8 at 7:38
  • Outbound traffic were unrestricted. I create another instance to do some testing and if open all the Inbound port Filezilla works. So after some testing I could reduce it to range 59000-60000 and still works. I will wait for customer to give me the exact range. Thanks – Juan Carlos Oropeza Oct 8 at 20:42
2

Outbound connections are not blocked by default, usually 0.0.0.0/0 Can you browse the ftp site from your EC2 instance? ftp://site.com

They may have allowed a certain IP to connect on their side (your home), but not your VPC in AWS.

  • I can't browse the ftp://site.com. Even when I get login/password prompt, After enter my credential get This site can’t be reached both in my home as in my EC2. Filezilla connect ok from my home. I talk with my customer and they said dont have any ip blocking – Juan Carlos Oropeza Oct 6 at 5:21
  • But you can browse the site in a browser from home? That's good in that it limits the scope of the issue, but hard to say why AWS is doing something to block it. Sorry i can't be of more help really :( – Edwrd_T_Justice Oct 6 at 5:42
  • I cant browse ftp using chrome. Not at home not at Amazon. Same message after I enter credentials. – Juan Carlos Oropeza Oct 6 at 7:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.