Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm suing FTPS in WinScp for sending data to my Synology diskstation. When I'm doing it inside a private network using port 21 for connection everything works fine. But when I'm trying the same thing over the internet, I get a connection error once the data transfer should begin. It seems like the connection is successfully done.

My best guess is that its because the file transfer is using another port than 21 and is being blocked by the firewall. It could also be that I'm not congratulating the firewalls correctly for port 21 in my current set up.

share|improve this question

1 Answer 1

According to Wikipedia, FTPS have some firewall incompatibilities:

Because FTP utilizes a dynamic secondary port (for data channels), many firewalls were designed to snoop FTP protocol control messages in order to determine which secondary data connections they need to allow. However, if the FTP control connection is encrypted using TLS/SSL, the firewall cannot determine the TCP port number of a data connection negotiated between the client and FTP server. Therefore, in many firewalled networks, an FTPS deployment will fail when an unencrypted FTP deployment will work. This problem can be solved with the use of a limited range of ports for data and configuring the firewall to open these ports.

However, another question on Stackexchange Serverfault lists some ways to solve your problem:

To know exactly what ports you will need to open, you will need to either:

a) talk to the vendor to get specifics about how their system has been configured.

b) Use a protocol analyzer, such as tcpdump or wireshark, to look at the traffic, both from outside your firewall and inside your firewall

You need to find out which port is the Control Connection. You list 3, which seems odd to me. Assuming the server only works in PASV (passive) mode, you need to figure out how the server is configured to allocated DATA ports. Have they locked down the DATA channel to a single inbound port? Have they locked down the DATA channel to a small range or ports?

With these answers, you can start configuring your firewall.

(Answeared by pcapademic on May 21 '09 at 20:28).

share|improve this answer
    
Thanks for the information! Could this be the answear to my question? "21 (command), 20 (Data connection in Active Mode), 55536-55663 (Data connection in Passive Mode)" from here –  Tim May 18 '12 at 11:22
    
@Tim: According to the reffered site, it seems it could be. I would take a try. –  Diogo May 18 '12 at 11:24
1  
Thank you, I will try it out later today and come back whit the results. Your information seems to be very helping! –  Tim May 18 '12 at 11:27
    
Hi, I've finally got it working! But I'm not yet sure what of all changes did the thing. I'll research it and explain it later. –  Tim May 19 '12 at 18:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.