Linux – Need FTP Proxy for RHEL as RPM

Frequently, corporate web proxies will allow a CONNECT to port 443 only. Filezilla will be attempting to connect to port 21 (FTP command port) through your proxy but your proxy is telling you that is forbidden.

So how to get around this? Set up a virtual machine running Linux somewhere on the public internet. Configure port 443 as a SSH server port. Use putty to make a connection via your web proxy to port 443 on your virtual server, and set up SOCKS proxying through that connection (tunnel). Finally, configure Filezilla to use your local SOCKS proxy (which is really redirecting connections to your virtual Linux host through the SSH tunnel established over your web proxy).

Changing the dynamic port range in windows will not help. The only thing it does is limit what port will be used for the client side of a socket connection.

What you need to do is limit the port range used by IIS's FTP server. There is a pretty good blog post about that on MSDN but here are the high points:

• If you're using the built-in FTP server, you need to first install the "IIS 6 metabase compatibility" role service (as well as the associated scriting tools) and then use the following command to set the proper metabase property:

  adsutil.vbs set /MSFTPSVC/PassivePortRange "5500-5525"

  • If you're using the IIS 7.5 downloadable FTP module (the one you get from this page) then all you need it open the server's configuration editor and edit the "data channel port range" property under "FTP Firewall Support > Data Channel Port Range" in applicationHost.config.

Regardless of the above, you will still need to port forward the whole range on your NAT gateway device for external connections to work. Most descent Firewall/NAT devices have protocol helpers included for FTP that will allow them to identify the PASV command and react accordingly, but not all do (and it usually won't work if you're using non-standard port for the FTP command channel).

P.S. You should consider using a different protocol than FTP if you're behind NAT: you can't make it work without ugly - and risky - workarounds. I suggest you investigate SFTP or WebDAV.