Firewall – What ports does Wininet listen on for Active FTP data connection

firewallftp

I have an application using Wininet.dll for all its FTP operations.

OS is Windows Server 2003.
FTP mode is Active FTP.

Unfortunately the port that the FTP server listens on is non-standard (i.e. it's not 21).
This means that the Sonicwall firewall between me and the FTP server is not clever enough to automatically recognise Active FTP sessions on source port 20 and allow the data connection to connect back through.

I must explicitly list the inbound ports I wish to open so that the data connection from the FTP server can get back to the client application.

How do I control the range of ports that Wininet listens on for an active FTP connection – as opening all ports (or an unnecessarily large range) from this destination is not an option.

I'm sure this setting is buried in the registry somewhere – but google is not helping me find this.

Many thanks,
David.

Best Answer

Both ports 20 and 21 are FTP ports. 21 is the first port that initiates the connection. The actual xfer of the files is done on port 20. You can read more of it here. You might double check your sonicwall and see how it's setup, see if you have port 20 assigned to anything. Otherwise create a Group Rule for both ports 20 and 21, and use that Group rule for your NAT rather than just using port 21.

Related Solutions

FTP hangs on: 150 Opening ASCII mode data connection

FTP server and FTP client negotiates which ports are going to be used for the transfer of data (including the directory list when you do a "dir" or "ls") using the "control channel" of FTP. So if your "AWS firewall" is not doing protocol inspection on this channel there is no way he will know which ports it has to dynamically open to allow the traffic flow (and close once those ports are not longer used).

IMHO using network monitoring to discover which ports are being used is not worth the effort because these ports are going to change for every new FTP session.

Unless you have already done it, my best shot at troubleshooting this issue would be to look for any tweak on the firewall that is protecting your FTP server (if I understand your question correctly this would be the "AWS firewall") and see if there is any "knob" to enable inspection for the FTP protocol.

Firewall – what ports do I open on windows server 2008 firewall for command line ftp to work

When creating the FTP site in IIS you have the choice of which dynamic ports to use. Whatever ports are set there need to be open in the firewall.

Or, you need to use an FTP client that supports PASV mode, which forces all transfers over the FTP port. But the command line from Microsoft does not support that.

The other option that you have would be to enable Stateful FTP inspection of the firewall. After opening the FTP (21) port, issue the following command on the server at the command line:

netsh advfirewall set global StatefulFtp enable

I believe that only works on Vista, Windows 7, and 2K8 "servers."

Best Answer

Related Solutions

FTP hangs on: 150 Opening ASCII mode data connection

Firewall – what ports do I open on windows server 2008 firewall for command line ftp to work

Related Topic