Windows – How to allow FTP on Google Compute Engine Windows VM

Target and source tags are only available for internal use only if no network is specified on the rule, as you mentioned in your question If both sourceRanges and sourceTags are specified, an inbound connection is allowed if either the range or the tag of the source matches sourceRanges or sourceTags. So in order to make it secure, allow your local network IP range (where you are trying to connect from) only on the firewall.

Add the following:

PassivePortRange 50000 55000

in

/etc/pure-ftpd.conf

and i think that your problem will be solved. Keep in mind that this port range should also be allowed in your firewall.

EDIT:

Quoted from this wonderful source:

In passive mode FTP the client initiates both connections to the server, solving the problem of firewalls filtering the incoming data port connection to the client from the server. When opening an FTP connection, the client opens two random unprivileged ports locally (N > 1023 and N+1). The first port contacts the server on port 21, but instead of then issuing a PORT command and allowing the server to connect back to its data port, the client will issue the PASV command. The result of this is that the server then opens a random unprivileged port (P > 1023) and sends P back to the client in response to the PASV command. The client then initiates the connection from port N+1 to port P on the server to transfer data.

the trick here is that with the

PassivePortRange 50000 55000

directive will force pureFtp to pick random ports from this range that you have previously allowed in your firewall.