I have an FTP server that supports passive server mode (using PASV command). This works fine with Windows XP. When I want to access this server from Windows Vista or Windows 7 with firewall enabled I experience an immediate connection shutdown. A reset packet is sent to the server, and the socket is signaled that the server has reset the connection (what is not true).

The problem disappears when the firewall is disabled.

Connections to other FTP servers work correctly. The difference is that the server's response to PASV does not enclose the address field with parentheses. This is legal as documented in RFC-959 and RFC-1132.

How can I configure the firewall to stop this bad behavior?


I don't think that the parenthesis are to blame.
I would rather think that the dynamic port-range allocated by that server disagrees with Vista/7.

For a discussion of the subject, see this article :
The default dynamic port range for TCP/IP has changed in Windows Vista and in Windows Server 2008

To view the dynamic port range on your computer for ipv4, use the following command :

netsh int ipv4 show dynamicport tcp 

To set the dynamic port range for TCP, use for example :

netsh int ipv4 set dynamicport tcp start=1024 num=30000

More commands are described in the above article.

EDIT : Please note that the Windows firewall may be intelligent enough to open a dynamic port specified in the PASV response, even if this port doesn't fall within its default range for dynamic ports. But it may be that it is still not intelligent enough to understand the response without the parentheses. It may pay to have a look at the possibility of extending the default range for dynamic ports.

  • @harrymc: I have verified that the parenthesis are in question. The problem vanishes, when I change the FTP server to added parenthesis. – harper Apr 29 '11 at 12:16
  • Is this your own ftp server and you control its source? – harrymc Apr 29 '11 at 12:21
  • Yes, I can control the source for new devices. But changing existing devices in the field is very expensive. – harper Apr 29 '11 at 12:46
  • Which ftp clients have you tried? – harrymc Apr 29 '11 at 13:09
  • 1
    Harper, the behavior of active and passive ftp is totally different as regarding ports. The firewall will have no problems with active ftp which uses only well-known ports (20,21). If you won't check the dynamic port range used with your server against the default allowed by Windows Vista/7, then we won't know whether my answer is right or wrong. – harrymc May 2 '11 at 11:35

This reminds me of an issue I had with Java and FTP running under Windows 7.


It ended up being a bug with Microsoft's firewall with FTP, passive mode, and IPv6 connections (the address did not need to be an IPv6 one, just the software that made the connection does so using the IPv6 stack).

The symptom described in your question sounds very similar to this issue, so I'll link and summarize here (even though this question has nothing to do with Java the fix may be the same)

A summary of a few solutions mentioned there:

  • Microsoft hotfix: http://support.microsoft.com/kb/2754804
  • Attempt to make your FTP client running under Vista/7 run with an IPv4 stack (may be possible, may not be)
  • Disable Windows firewall's stateful FTP using netsh advfirewall set global StatefulFTP disable (this however will disable non-passive mode FTP connections punching through your firewall)
  • This KB article describes the cause as a problem with the IPv4/IPv6 synchronization of dual mode sockets. It might be that the hotfix would also silently fix the parenthesis bug. But the hotfix should "only be applied to systems that experience the described proble". Since the problem isn't IPv6 related I am a bit reluctant to install it. – harper Jan 31 '13 at 9:54

You can't configure the firewall because it's just buggy.

As long as you can't change the FTP server to send the port information in parentheses because it's built in in old devices in the field, you need a special client with the following behavior.

This client must send a TYPE I command immediately before each PASV command to keep the firewall in a sane state. If you need a non-binary transfer you might change the parameter of the TYPE command.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.