Standard FTP Connections From Inside Google Compute Platform

Question

I recently set up a new Windows server inside the Google Compute Engine, and am trying to establish an outbound unsecured FTP connection from the VM to an FTP server hosted on the Internet.

I am able to connect and log in, but as soon as I try to send/download a file or do a simple directory listing, I receive one of several errors, including: a) Connection closed by remote host, b) Illegal port command, or c) Unable to build data connection: Connection refused. WireShark confirms that the problem happens when the FTP client attempts to establish a connection over the data channel, TCP port 20.

I have tried this with three different sites on the Internet that all work fine from my laptop and servers hosted outside of Google Compute on different Internet connections without any problems. I also tried configuring the system to use a SOCKS proxy server for FTP, and got the same results. I also tried routing the traffic across a site to site VPN to a router at another site, where I am able to successfully connect to the FTP server.

I ultimately set up an L2TP/IPSec Windows client VPN connection from the Google Compute Engine VM to a router at another site, and am able to access teh FTP site sucessfully. I've been through the firewall rules and routes in Google Compute Engine several times.

Is anyone aware of a Google policy that blocks outbound unsecured FTP connections? I know that they essentially enforce secure mail connections, and am wondering if a similar policy applies here. I also prefer secure FTP, but in this case, the vendor on the other end only supports insecure FTP.

Thank you in advance.

It seems like a firewall issue on the server. Why don't you try disabling it completely for a quick test? — Julie Pelletier, Aug 08 '16 at 05:34
Thanks. The firewall is disabled. I'm also finding that I'm unable to make outbound SMTP connections on ports 25 and 587. — Clint, Aug 08 '16 at 14:06
You should double-check there is no firewall on this machine and also the other end-point of the VPN. — Julie Pelletier, Aug 12 '16 at 17:46

score 1 · Answer 1 · edited May 23 '17 at 12:41

As Julie Pelletier mentioned in her comment your ftp issue should be related to your Windows VM internal firewall. You will need to add appropriate firewall rules to let FTP connection established correctly. FTP connections can be established in Active or Passive mode. Firewall rules should be planned and added based on the mode of connection. You can read about these modes in this stackoverflow thread.

Regarding other question in your comment, yes Google Compute Engine does not allow outbound connections on ports 25, 465, and 587. By default, these outbound SMTP ports are blocked because of the large amount of abuse these ports are susceptible to. You can read more about this in this article.

Standard FTP Connections From Inside Google Compute Platform

1 Answers1