up vote 0 down vote favorite
share [g+] share [fb]

I have an FTP server that supports passive server mode (using PASV command). This works fine with Windows XP. When I want to access this server from Windows Vista or Windows 7 with firewall enabled I experience an immediate connection shutdown. A reset packet is sent to the server, and the socket is signaled that the server has reset the connection (which is not true).

The problem disappears when the firewall is disabled.

Connections to other FTP servers work correctly. The difference is that the server's response to PASV does not enclose the address field with parentheses. This is legal as documented in RFC-959 and RFC-1132.

How can I configure the firewall to stop this bad behavior?

link|improve this question
56% accept rate
feedback

1 Answer

up vote 0 down vote

I don't think that the parenthesis are to blame.
I would rather think that the dynamic port-range allocated by that server disagrees with Vista/7.

For a discussion of the subject, see this article :
The default dynamic port range for TCP/IP has changed in Windows Vista and in Windows Server 2008

To view the dynamic port range on your computer for ipv4, use the following command :

netsh int ipv4 show dynamicport tcp

To set the dynamic port range for TCP, use for example :

netsh int ipv4 set dynamicport tcp start=1024 num=30000

More commands are described in the above article.

EDIT : Please note that the Windows firewall may be intelligent enough to open a dynamic port specified in the PASV response, even if this port doesn't fall within its default range for dynamic ports. But it may be that it is still not intelligent enough to understand the response without the parentheses. It may pay to have a look at the possibility of extending the default range for dynamic ports.

link|improve this answer
@harrymc: I have verified that the parenthesis are in question. The problem vanishes, when I change the FTP server to added parenthesis. – harper Apr 29 '11 at 12:16
Is this your own ftp server and you control its source? – harrymc Apr 29 '11 at 12:21
Yes, I can control the source for new devices. But changing existing devices in the field is very expensive. – harper Apr 29 '11 at 12:46
Which ftp clients have you tried? – harrymc Apr 29 '11 at 13:09
1  
Harper, the behavior of active and passive ftp is totally different as regarding ports. The firewall will have no problems with active ftp which uses only well-known ports (20,21). If you won't check the dynamic port range used with your server against the default allowed by Windows Vista/7, then we won't know whether my answer is right or wrong. – harrymc May 2 '11 at 11:35
show 5 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.