Firewall – What firewall ports do I need to open when using FTPS

firewallftpport

I need to access an FTPS server (vsftpd) on a vendor's site. The vendor has a firewall in front of the ftps server. I have a firewall in front of my FTPS client.

I understand that ports 990, 991 and maybe 989 need to be opened up for control traffic.

I have some questions:

  1. When looking at it from the vendor's firewall perspective, should these ports be opened up for both inbound and outbound traffic?
  2. What about ports for the DATA channel?
  3. Do I have to open all ports above 1000?
  4. Should I do it for both inbound and outbound traffic ?

Best Answer

My understanding of FTP over SSL (ftps) is that it doesn't work well with firewalls and NAT. In an ordinary FTP session, the information about data connections is read, and for NAT modified, by the firewall in order for the firewall to dynamically open the needed ports. If that information is secured by SSL, the firewall can't read it or change it.

Using SFTP, or scp, makes the network administrator's job a lot easier - everything happens on the server's port 22, and the transaction follows the normal client/server model.

One thing not mentioned is whether or not your firewall is performing NAT and whether or not it is static NAT or dynamic NAT. If your client machine has a static address or is being statically NATed, you may not need to make any firewall changes, assuming you allow all outbound traffic and the server operates only in Passive mode (PASV).

To know exactly what ports you will need to open, you will need to either:

a) talk to the vendor to get specifics about how their system has been configured.

b) Use a protocol analyzer, such as tcpdump or wireshark, to look at the traffic, both from outside your firewall and inside your firewall

You need to find out which port is the Control Connection. You list 3, which seems odd to me. Assuming the server only works in PASV (passive) mode, you need to figure out how the server is configured to allocated DATA ports. Have they locked down the DATA channel to a single inbound port? Have they locked down the DATA channel to a small range or ports?

With these answers, you can start configuring your firewall.

Related Topic