For FTP you will want to ensure you open both TCP ports 20
and 21
. Additionally, if the server service running on the machine uses passive mode, then you will also need to open up the TCP port range the FTP server is configured to use.
Quick Port Breakdown
It appears you are running insecure FTP on
TCP ports 20
and 21
(i.e. active and passive), and maybe also
FTPS with implicit SSL on TCP
port 990
and 989
.
The FTP protocol uses a port/channel for the controls/commands and
another port/channel for the data exchange portion of the client and
server.
Insecure
FTP
- Command channel: TCP Port
21
- Data channel (active): TCP port
20
- Data channel (passive):
<FTP Server configured TCP port range>
FTPS with implicit SSL
- Command channel: TCP Port
990
- Data channel (active): TCP port
989
Command Line Firewall (this section should fix the problem)
Run the below in command line elevated as administrator to create a Windows Firewall rule allowing inbound traffic to your FTP server service to communicate on the applicable command and data ports for any IP address and any profile scope of Windows OS classified networks.
You need to specify the program="<C:\FTPServer\FTPServer.exe>"
value appropriate to your server or else use the service=<ftpsvc>
in its place instead pointing to the service name instead.
netsh advfirewall firewall add rule name="FTP Inbound" dir=in action=allow program="%windir%\system32\svchost.exe" remoteip=any localip=any protocol=TCP localport=20,21,990,989 remoteport=20,21,990,989 profile=any
Run the below to disable stateful FTP filtering so that the firewall does not block any FTP traffic so you don't need to open up the entire passive port range to allow that traffic.
netsh advfirewall set global StatefulFTP disable
Windows Firewall GUI
Be sure that you have the scope defined in the rules so the IP address range of the LAN are allowed through or else allow any IP address through. Lastly, you will want to ensure the network adapters on the server are configured in a profile the firewall rule allows.
Ports
Note: Add the passive port range if applicable.
![enter image description here](../../I/static/images/4e4e33f1aef123e504ff67e1345ae330096a26680b690166b96b3c5d43af7212.png)
Scope
![enter image description here](../../I/static/images/81906008a1d0afe927f88cd4b5b0a1d515f1c41a8df4589d60d834e9ad1ff89c.png)
Profiles
![enter image description here](../../I/static/images/443ebd9f73b7687dfed0086f0a00135c70ecac97fbf2b7c4336c55a7a1172031.png)
Further Resources
What exactly I have to do? Just want to note that it seems that I have multiple instances of same rule. For example in above question screenshots I have two entries of "FTP Server (FTP Traffic-In)". Similar for other entries. I dont know if they are duplicate, just that it seems same to me. I have uploaded screenshots of different tabs of different distinct rules arranged vertically one below other (read titlebar of windows for rule name) here. As you can see, local/remote ports checkbox is greyed out. (continued...)
– Maha – 2018-04-01T10:55:20.007(...continued) Rest of the settings I have done the way you told. But not working yet. Please see screenshots once and tell me what I am missing. – Maha – 2018-04-01T10:56:50.927
I am using Windows's built in FTP which can be enabled through "Turn Windows features on or off" window. And managing it through IIS Management console. – Maha – 2018-04-01T15:10:20.973
And I have
%windir%\system32\svchost.exe
listed in This program field of Program and Services tab of all thos FTP related inbound rules. – Maha – 2018-04-01T15:14:21.290I ran
netsh advfirewall set global StatefulFtp disable
and thennetsh advfirewall firewall add rule name="FTP Inbound" dir=in action=allow program="%windir%\system32\svchost.exe" remoteip=any localip=any protocol=TCP localport=20,21,990,989 remoteport=20,21,990,989 profile=any
. Now its working!!! It seems a lot complex than I thought it would be. Now I have to understand all this :( Super thanks anyway. And if possible please summarize what was the issue and how you solved it. I mean I really dont understand the command. Understanding it will consume some hours now :( – Maha – 2018-04-01T17:13:18.923@Mahesha999 I've updated my answer and cleaned up my comments on those pointers, etc. that helped you resolve. – Pimp Juice IT – 2018-04-01T17:51:12.030
1@pimp juice it, dude.. nice answer! – Tim_Stewart – 2018-04-02T00:08:48.987
Why are you restricting remote ports? Why in your command you're restricting it to 989 and 990 (both local and remote) while in your screenshot you're using a port range? – drizin – 2019-07-23T16:27:21.533
Your rule worked fine for me as long as I don't restrict remote ports and use the wide port range (20,21,50000-55000) for local port. This range associated to the svchost.exe look safe enough. – drizin – 2019-07-23T16:29:16.107