Ftp – Why won’t the router forward ports correctly

ftpportport-forwardingrouterwindows-server-2003

I have a Linksys RV042 dual-wan router (which directly responds to any traffic at *.*.*.*) and my FTP server is running Windows Server 2003 R2 SP2 and IIS.
My server's local IP address is *.*.*.*

My router's port forwarding configuration looks like this:

DNS [UDP/53~53]->*.*.*.*
HTTP [TCP/80~80]->*.*.*.*
FTP [TCP/20~21]->*.*.*.*

The forwarded port configuration looks like this:

MXToolBox.com reports that my ports are open.

My server responds perfectly to ftp://<Server's Local Name>/ from any computer on my local network. Anonymous access to my FTP server is allowed from anywhere, and my server responds to the stardard FTP ports: 20-21

But when anyone tries to access ftp://joinedsoftware.com/ there is no response.

I have tested DNS from internal and external computers, and everything seems to resolve without any problems.

Using SmartFTP, this is what the log shows: 

[12:45:20] SmartFTP v4.0.1122.0
[12:45:21] Resolving host name "joinedsoftware.com"
[12:45:21] Connecting to *.*.*.* Port: 21
[12:45:21] Connected to joinedsoftware.com.
[12:45:21] 220 Microsoft FTP Service
[12:45:21] USER anonymous
[12:45:21] 331 Anonymous access allowed, send identity (e-mail name) as password
[12:45:21] PASS (hidden)
[12:45:21] 230 Anonymous user logged in.
[12:45:21] SYST
[12:45:21] 215 Windows_NT
[12:45:21] Detected Server Type: Windows NT
[12:45:21] RTT: 6.702 ms
[12:45:21] FEAT
[12:45:21] 211-FEAT
[12:45:21]     SIZE
[12:45:21]     MDTM
[12:45:21] 211 END
[12:45:21] Detected Server Software: Microsoft IIS FTP Service
[12:45:21] TYPE I
[12:45:21] 200 Type set to I.
[12:45:21] REST 0
[12:45:21] 350 Restarting at 0.
[12:45:21] PWD
[12:45:21] 257 "/" is current directory.
[12:45:21] TYPE A
[12:45:21] 200 Type set to A.
[12:45:21] PASV
[12:45:21] 227 Entering Passive Mode (*,*,*,*,6,64).
[12:45:21] Opening data connection to *.*.*.* Port: 1600
[12:45:21] LIST -aL
[12:45:34] 425 Can't open data connection.
[12:45:34] PORT *,*,*,*,10,252
[12:45:34] 200 PORT command successful.
[12:45:34] LIST -aL
[12:45:34] 150 Opening ASCII mode data connection for /bin/ls.
[12:45:55] 425 Can't open data connection.
[12:46:25] NOOP
[12:46:25] 200 NOOP command successful.
[12:46:55] NOOP
[12:46:55] 200 NOOP command successful.
[12:47:25] NOOP
[12:47:25] 200 NOOP command successful.

What could be causing this scenario? Are there known issues with this router, or special router configurations that need to be set?

Best Answer

Because FTP is an awful protocol (there, I said it!):

[12:45:21] 227 Entering Passive Mode (173,14,245,129,6,64).
[12:45:21] Opening data connection to 173.14.245.129 Port: 1600
[12:45:21] LIST -aL
[12:45:34] 425 Can't open data connection.
[12:45:34] PORT 10,0,0,200,10,252
[12:45:34] 200 PORT command successful.
[12:45:34] LIST -aL
[12:45:34] 150 Opening ASCII mode data connection for /bin/ls.
[12:45:55] 425 Can't open data connection.

You see where your FTP client attempts to open a second connection to 173.14.245.129:1600? That's the 'data channel', which uses a seperate high-number port for return traffic/data. In Passive Mode, the server says "Please connect to x.x.x.x:y for the data channel."

You will have to configure a range of data channel port numbers to use in your FTP server and then allow them through the firewall. Active mode will probably not work unless you are allowing all outbound traffic.

Also, for the love of whatever computer Gods there may or may not be, please do not open NetBIOS and LDAP to the public internet and then post your IP address on ServerFault!

Related Topic