Firewall – How to configure Windows Firewall for FTP Server

FTP server and FTP client negotiates which ports are going to be used for the transfer of data (including the directory list when you do a "dir" or "ls") using the "control channel" of FTP. So if your "AWS firewall" is not doing protocol inspection on this channel there is no way he will know which ports it has to dynamically open to allow the traffic flow (and close once those ports are not longer used).

IMHO using network monitoring to discover which ports are being used is not worth the effort because these ports are going to change for every new FTP session.

Unless you have already done it, my best shot at troubleshooting this issue would be to look for any tweak on the firewall that is protecting your FTP server (if I understand your question correctly this would be the "AWS firewall") and see if there is any "knob" to enable inspection for the FTP protocol.

On Windows Server 2003 and Windows XP the default range of ephemeral ports used by client applications is from 1025 through 5000. Under certain conditions it is possible that the available ports in the default range will be exhausted.

netstat -n or netstat -b to see active connections

Increase the upper range of ephemeral ports that are dynamically allocated to client TCP/IP socket connections.

1. Start Registry Editor.
2. Browse to, and then click the following key in the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
3. On the Edit menu, click New, DWORD Value, and then add the following registry value to increase the number of ephemeral ports that can by dynamically allocated to clients: Value name MaxUserPort Value data
4. Close Registry Editor.

Note: You must restart your computer for this change to take effect.

Note: Increasing the range of ephemeral ports used for client TCP/IP connections consumes Windows kernel memory. Do not increase the upper limit for this setting to a value higher than is required to accommodate client application socket connections so as to minimize unnecessary consumption of Windows kernel memory.