0

I have a very basic FTP server running on Windows 10. Right now, I have no trouble accessing this server from my WLAN. However, when I try to connect from outside my network—using my public IP on port 21—I get an error message from Chrome, Windows Explorer, Mozzila, Filezilla, etc.

I’ve checked several times and port 21 is open using CanYouSeeme.org. Also, when I do a test on FTP test using my public IP on port 21 everything seems to be fine, I even get a directory listing of the files I currently have on the working directory.

What could be the issue?

Additional info: I added the rule for FTP on my firewall, but now firewall is turned off for both private and public networks.

3
  • Are you using passive or active FTP? Also, are you behind Network Address Translation (NAT, commonly used on routers)?
    – CBHacking
    Sep 1, 2015 at 0:39
  • @CBHacking yes, I'm behind a NAT service. And I'm not sure about the other one, I just created the FTP service using Windows IIS manager.
    – gemathus
    Sep 1, 2015 at 1:45
  • What error message do you get? Are you having problems connecting or retrieving directory listing/transferring files? Can you show us FileZilla log? Sep 1, 2015 at 9:21

2 Answers 2

2

I suspect you are using Active FTP. Active FTP requires that the client be able to listen on an incoming port. A service like CanYouSeeMe is probably configured to support this, automatically opening the incoming port when needed. However, if your client is behind NAT (that is different from your server's NAT) then the client will not be able to use Active FTP because the port that the client needs to listen on will not be forwarded from the NAT router.

To avoid this problem, you need to use Passive FTP. Passive FTP has the client initiate both connections. This means that the client doesn't need to mess around with incoming firewall rules or NAT port forwarding. However, it also means that you need to open at least two ports on the server side: the FTP command port (21) and one or more FTP data ports (which can be anything above 1024) and then tell the server to use those ports for data. These ports need to be both allowed in the firewall (when you have it enabled) and forwarded through the NAT (unless your server is running in the NAT DMZ, in which case all unexpected traffic is forwarded to it but you really should turn the firewall back on).

This page isn't the best explanation of active and passive FTP, but it does talk about configuring IIS for passive FTP so maybe it will help you: http://www.velikan.net/iis-passive-ftp/

1
  • thanks a lot! I'll give it a shot tomorrow, but thanks a lot for your time. What you said seems to make a lot of sense.
    – gemathus
    Sep 1, 2015 at 4:23
0

Passive FTP helps if your client is behind a NAT gateway (or firewall). Active FTP helps if your server is behind a NAT gateway (or firewall). You can't be both active and passive on the same operation.

You can make this work if one of the two NAT gateways contains FTP ALG (Application-Layer Gateway) code to allow both active and passive FTP to work. It's rare to find a NAT gateway with FTP ALG code to allow a server behind the NAT to be reached via Passive FTP, but it's somewhat less rare to find a NAT gateway with ALG code to allow an inside client to reach an outside server via Active FTP.

Most modern FTP clients default to Passive FTP. If I were you, I'd tell my client to try Active FTP in hopes that the NAT gateway my client is behind has a client-style FTP ALG in its NAT gateway code.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .