FTP Tunnel using netsh command on Windows pc through to VMS FTP server

Question

I am trying to use a netsh command to help setup an FTP "Tunnel".

netsh interface portproxy add v4tov4 listenport=21 listenaddress=0.0.0.0 connectport=21 connectaddress=ftpserver

If I setup the tunnel on machine A this seems to work grand. If I go to machine B and ftp to machine A I do get the login for the ftpserver. However when I try to issue any commands I get errors like

425-Can't build data connection for x.x.x.x, 64009 425 connect to network object rejected

The problem I think is the returning connection is getting stuck at machine A , as it only forwards port 21 and not port 64009. I have setup machine A to forward port 64009 back to machine B, which does get further down the line but times out after;

150 Opening data connection for HOST:[FOLDERA].;* (x.x.x.x, 64009)

Am I doing this all the wrong way? or can someone offer advice.

Basically I am trying to access an ftp server from machine B which is on a different network, but machine A is on both networks ( two network cards)

I also tried forwarding port 20 as I did with port 21 as I believe this is used in FTP process but this did not help

Answer 1

It's not enough to forward only port 21. Even in passive mode FTP server gives other dynamic ports for data channels:

PASV
227 Entering Passive Mode (194,105,148,53,120,164)

Last two bytes (120 and 164 in this case) represent higher and lower bytes in two-byte port number (120 * 256 + 164 = 30 884). This numbers are taken from some range specific to FTP server. In order for client to connect to data channel you must forward all range of dynamic FTP server ports.

Unfortunately netsh utility doesn't has syntax to add forward rules for the range of ports, you are only able to add ports one-by-one.

Thus you have the options:

1. Add forwarding rules for the range of FTP dynamic ports. You can generate batch file with as many rows as needed to add rule for every port from range.
2. Use other stuff for this purpose. Almost every hardware router has such functionality.
3. Use Unix/Linux machine as router and setup iptables.