clients behind NAT will not be able to establish active data connections). It is NOT recommended for use any more because it is not friendly in internet scenarios (eg. This used to be the default way of connecting to FTP server in the past. To complicate things even more there are actually 2 different ways on how to establish data connection.Īctive data connections are the ones where client sets up port for listening and server initiates the connection to such port (typically from port 20). The challenge with FTP protocol doesn't end with the requirement of secondary data connection. These firewall filters are able to detect what ports are going to be used for data transfers and temporarily open them on firewall so that clients can open data connections. Some firewalls enable such filters by default but it is not always the case. Many firewalls simplify the challenge with data connections by scanning FTP traffic and dynamically allowing data connections through. It is because data connections for FTP server are not allowed to pass through the firewall. But having port 21 opened ONLY means that clients will be able to connect to FTP server, authenticate successfully, create, delete directories but will NOT be able to see directory listings or be able to upload/download files.
To open port 21 on firewall is an easy task. That is the one that typically connects to well known FTP port 21.Īny data transfer, such as directory listing, upload and download happen on secondary connection called data channel. The root cause for this challenge lies in the FTP protocol architecture.Įach FTP client requires 2 connections to be maintained between client and server.įTP commands are transferred over connection called control channel.
It is often a challenge to setup firewall rules for FTP server to work correctly.
This post does NOT address IP address translation related issues and other issues that apply when there is an external firewall (such as ISA server) between client and server.
The goal of this post if to provide instructions on how to setup local Windows Firewall to enable access to FTP over non-secure or secure connections. This post is the first one from the mini-series on firewall configuration for FTP7 (full product name: Microsoft FTP Publishing Service for IIS 7.0).
0 kommentar(er)
