5

I have a Windows Server 2012 R2 acting as an FTP client which needs to retrieve some files through FTP from a different device. If I turn off the firewall completely, the transfer is successful. With the firewall up, the process goes through but the file fails to be saved on the Windows server.

I have followed the Microsoft instructions on How to Configure Windows Firewall for a Passive Mode FTP Server, but this still resulted in failure.

I removed the previous firewall rule and replaced it with this one: 

New-NetFirewallRule -DisplayName "FTP Service In" -Direction Inbound -Protocol TCP –Enabled True –Action Allow -Profile Any -Service ftpsvc -LocalPort Any -EdgeTraversalPolicy Allow

I also tried to only affect ports 20 and 21. All with the same result.

Any suggestions on how to properly setup the firewall to allow FTP traffic to download files?

Improve this question

3 Answers 3

Reset to default
3

On Windows Server (2012 and 2012R2), in order to retrieve files using ftp get the program ftp.exe needs to have access to ports 20, 21, and 1024-65535, therefore, a new firewall rule has to be created. In this situation, the Windows server is an FTP client and the firewall rule can only apply to the FTP program, but not the service (ftpsvc).

New-NetFirewallRule -DisplayName "FTP In" -Direction Inbound -Protocol TCP –Enabled True –Action Allow -Profile Any -Program "%SystemRoot%\System32\ftp.exe" -Service Any -LocalPort 20,21,1024-65535 -EdgeTraversalPolicy Allow

The instructions covered by Microsoft in How to Configure Windows Firewall for a Passive Mode FTP Server are not useful in your case. They apply when you're running an FTP server, but you're using the FTP client on your Windows Server.

Improve this answer
1
  • This is correct. It's helpful to know the Windows built-in ftp.exe client only supports FTP Active mode, so this will only ever work if an active mode connection to the FTP server is possible (which is rare if it's behind a NAT device).
    – I say Reinstate Monica
    Sep 21, 2018 at 17:09
0
+50

If Windows Server 2012 acts in this case as a client in active mode, all it needs are ports 20 & 21 and 1024-65535.

The Microsoft link you have followed pertains to the case where it acts as a server, so may not apply.

For more information on ports, see this article :
Configure Your Clients Firewalls for Successful FTP Transactions (Retrieved 2017-01-11).

Improve this answer
7
  • Please see edited question. I created a firewall rule to allow ftp service on any port and still, same issue.
    – slybloty
    Feb 27, 2014 at 16:11
  • This is not enough. See the article in my edit above for the required ports according to active/passive mode. Remember that the Windows Server is the client in this case.
    – harrymc
    Feb 27, 2014 at 16:40
  • Applying the rule to the ftpsvc won't affect the ftp transfer, therefore, my firewall rule is useless.
    – slybloty
    Feb 27, 2014 at 17:42
  • Can you use the GUI instead of PowerShell?
    – harrymc
    Feb 27, 2014 at 18:47
  • 1
    I have awarded you the bounty because your answer helped me find the fix I needed. I din't accept your answer because it was very vague and not what I wanted. Thank you.
    – slybloty
    Feb 28, 2014 at 0:54
-1

If you need to troubleshoot this kind of problem this is recommended:

I had similar problem and highly recommend these EXCELLENT videos on FTP setup: https://www.youtube.com/watch?v=pSmlooPiHm4 (and two previous videos).

What someone suggested as well is to actually restart the whole Windows 2012 R2 server if you can.

Lastly, what helped in my case was to replace External IP Address of Firewall with local server's IP.

In case you can't see the image: in ISS Manager > go to your Sites > Choose FTP site > FTP Firewall Support > External IP Address of Firewall - you most likely have it autofilled with firewall IP. Change this to the local server's IP and test the FTP locally from the server itself (with e.g. FileZilla client). If it works, then you know it is firewall that causes the problem. Then change the IP back and look at firewall.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.