1

There is a software that depends on Windows ftp.exe to transfer files. Problem is, the computer that runs it is behind a very strict firewall, it does not work with Active FTP.

Windows FTP only works in Active FTP mode.

I was thinking of this solution. Sending a packet from a chosen port (for example 1027) to port 20 of the server address. The NAT firewall will then allow incoming access from port 20 to 1027. Then, the computer will send a PORT command to the server to inform that the client data port is 1027. The data transfer will then start.

Will it work? How do I make it work with Windows ftp program only?

Note: The server I am using is FileZilla FTP Server

  • Do you mean that the software calls Windows ftp.exe for the transfers? – Martin Prikryl Mar 3 '15 at 8:24
  • Yes. Here is the PORT Command it sent me (000004) 3/3/2015 1:52:09 AM - user (1.161.129.51)> PORT 10,10,1,239,217,24 As you can see, the server address does not tally with the PORT command. Usually the PORT command will be the same address as the address it originated from. There is an option on the FileZilla Server "Ignore unroutable IPs on PORT command" Should I enable it? Will it solve the problem? – Matty2 Mar 3 '15 at 9:25
0

I was thinking of this solution. Sending a packet from a chosen port(for example, 1027) to port 20 of the server address. The NAT firewall will then allow incoming access from port 20 to 1027. Then, the computer will send a PORT command to the server to inform that the client data port is 1027. The data transfer will then start.

I do not think you can tell ftp.exe to use a port of your choice. It sends the PORT with a port of its choice. You (the application) do not send it yourself.

There is an option on the FileZilla Server "Ignore unroutable IPs on PORT command" Should I enable it? Will it solve the problem?

It would help, had the problem be that the client does not know it's external IP address (meaning it sends wrong IP in the PORT command). What is actually the case (10.10.1.239 is local IP address that the server cannot reach), so you need to turn the option on. But you claim the problem is the firewall too. So while the option helps, it does not solve all the problems you have.


Obviously the easiest solution would be to reconfigure your firewall to allow the Active mode. That means to open incoming ports in data connection range.

See my article Network Configuration for Active Mode.

You can restrict the rules just for the server IP address. You can even restrict them further to remote port 20 only.


The only other idea I have is to develop a fake ftp.exe client that uses the Passive mode. It won't be that difficult, if you make use of some FTP client library, and restrict the client's functionality only to that the application really uses.

  • I have checked the option. I have also forwarded Port 21. I have also put my server in the DMZ. It worked when I try to access my server from a different network/place. It did not work in a corporate/campus network. – Matty2 Mar 3 '15 at 9:59
  • And did you open the data port range? – Martin Prikryl Mar 3 '15 at 10:00
  • Coincidentally, I have found a commercial replacement for the ftp.exe with passive mode support. See update to my answer. – Martin Prikryl Mar 3 '15 at 13:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.