Server 2019 Windows Firewall Blocking FTP Traffic With Port 21 and 20 Allowed

Christian Erdtmann 1

Hey i have a C# written software that try to download files via FTP. On my local machine it works fine. But on the server its blocked by the firewall. With firewall of it works. I allready added port 20 and port 21 to the rules. The Software works with passive mode.

Connection the the FTP works and it read the files and directorys. But by trying to download a file it get timeout.

Any Idea?

AgaveJoe 28,036 Reputation points

2022-02-22T19:48:05.13+00:00

In passive FTP. the initial request is on port 21. The download port is a random high port number. I think you need to configure the FTP server to use a certain range of ephemeral ports then allow the range in your firewall.

If you are not using passive FTP then opening ports 20 and 21 could work depending on the network.

Did you check the if the client has a virus checker or firewall that might be blocking? Perhaps try debugging with a network sniffer like Wireshark,
Christian Erdtmann 1 Reputation point

2022-02-22T19:54:07.957+00:00

I allready use passive ftp the connection works and it read the data on the ftp but when i try to download a file it break.
AgaveJoe 28,036 Reputation points

2022-02-22T22:29:17.773+00:00

You have to troubleshoot. Passive FTP works by the client connecting to the server's port 21 (the command port) and sending the PSAV command. The server response with a random data port (port number above 1024). The client connects to the data port to transfer data. This is helpful for getting around firewalls because the client is making the connections.

Have you tried using an existing FTP client like FileZilla? If you have the same issue with FileZilla then I assume the high numbered ports are being blocked. If FileZilla works then there's probably a bug in your code. Keep in mind the client can block traffic as well.

1 answer

Lex Li (Microsoft) 5,572 Reputation points Microsoft Employee

2022-02-23T03:21:10.567+00:00

FTP is an ancient protocol that works badly with firewalls, and merely opening up port 20/21 is far from enough, as active/passive modes each require other ports for data connections,

https://learn.microsoft.com/en-us/iis/publish/using-the-ftp-service/configuring-ftp-firewall-settings-in-iis-7#more-information-about-working-with-firewalls

You really need to learn more about the actual protocol (FTP commands) and how the packets go through ports, so as to learn how to properly set up firewall rules. The FTP server administrators might give you more hints.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Server 2019 Windows Firewall Blocking FTP Traffic With Port 21 and 20 Allowed

1 answer

Your answer