How to configure the port range for passive FTP connection ? -- iis ftp

Elga
10/3/2004 5:43:01 PM

Thanks, Bernard.
A few minutes later I had posted my question, I discovered your article in
another thread.
I followed the instructions, and I solve the first part of my problem: open
a limited range of ports.

But I saw another obstacle: my server is behind a NAT. This is an appliance
that works as a mix of router, firewall and NAT. I use this appliance to
share the Internet connection in my LAN.
When my FTP server answers to a cliente request in passive mode, it send its
local IP, instead the external IP used in Internet connections. Because of
this, the client will try to connect to an IP that doesn't exists in the
Internet.

Is there any solution for this ?
Could I force the FTP server to send the external IP in the answer to PASV
command ?

Thanks,

Elga.

[quoted text, click to view]

Bernard
10/4/2004 12:29:20 AM

Have you try this ?

How To Configure PassivePortRange In IIS
http://support.microsoft.com/?id=555022

--
Regards,
Bernard Cheah
http://www.tryiis.com/
http://support.microsoft.com/
http://www.msmvps.com/bernard/

[quoted text, click to view]

Bernard
10/4/2004 10:46:02 AM

This was discussed weeks ago, again this is sort of 'by design' in current
implementation.
I would suggest you read the following:

watchout for url wrap:
http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&frame=right&th=ee013501d615f1c0&seekm=3A488543-D58D-4F84-ABCF-055E9F7C0084%40microsoft.com#link1

--
Regards,
Bernard Cheah
http://www.tryiis.com/
http://support.microsoft.com/
http://www.msmvps.com/bernard/

[quoted text, click to view]

David Lewis
10/4/2004 5:00:09 PM

ok so this must be the same issue I am having.

I have raidenftpd running at home on a non 21 port on a linksys befsr81. It works just fine, but I have never tested it
with IE since it is a SSL only ftp site.

At my main office I have a sonic wall tz170 using IIS in windows 2003 and I did nothing special and it works out of the
box with smartftp and IE.

My satellite office has a linksys befsr41 and windows 2000 ftp server.

So to sum up what you are saying is browsing a ftp site via IE is not possible with a cheepo linksys router?

"Bernard" <qbernard@hotmail.com.discuss>
|>This was discussed weeks ago, again this is sort of 'by design' in current
|>implementation.
|>I would suggest you read the following:
|>
|>watchout for url wrap:
|>http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&frame=right&th=ee013501d615f1c0&seekm=3A488543-D58D-4F84-ABCF-055E9F7C0084%40microsoft.com#link1

Alun Jones [MSFT]
10/4/2004 5:04:05 PM

[quoted text, click to view]

If the BEFSR81 is running as a NAT, then that site will not work in PASV
mode, and will only work with clients in active mode if those clients have
public IP addresses. That's a hazard with FTP over SSL - because you've
encrypted the traffic, the NAT cannot possibly monitor and change it to
alter the address or port. Setting the IP address specifically is not
necessarily a reliable answer - the letter missing from NAT is P - NAPT is
the strict term, for "Network Address and Port Translation".

As you can imagine, if the port on the outside is different from the port
inside the NAPT device, you will inadvertently be connecting those FTP data
connections to random ports unassociated with them.

[quoted text, click to view]
possible with a cheepo linksys router?

I've had it work fine with a BEFSR41 - however, the control channel needs to
be unencrypted, and the FTP server needs to be bound to port 21.

Alun.
~~~~

David Lewis
10/5/2004 2:24:33 PM

2 separate issues here.
My home site with a non standard port and SSL works just fine, even with
users behind nat. The only problem I have is companies that block high port
access. Oh well:))

the other issue was solved in IE options by turning off use passive ftp.

"Alun Jones [MSFT]" <alunj@online.microsoft.com>
[quoted text, click to view]
|>> I have raidenftpd running at home on a non 21 port on a linksys befsr81.
|>It works just fine, but I have never tested it
|>> with IE since it is a SSL only ftp site.
|>
|>If the BEFSR81 is running as a NAT, then that site will not work in PASV
|>mode, and will only work with clients in active mode if those clients have
|>public IP addresses. That's a hazard with FTP over SSL - because you've
|>encrypted the traffic, the NAT cannot possibly monitor and change it to
|>alter the address or port. Setting the IP address specifically is not
|>necessarily a reliable answer - the letter missing from NAT is P - NAPT is
|>the strict term, for "Network Address and Port Translation".
|>
|>As you can imagine, if the port on the outside is different from the port
|>inside the NAPT device, you will inadvertently be connecting those FTP data
|>connections to random ports unassociated with them.
|>
|>> At my main office I have a sonic wall tz170 using IIS in windows 2003 and
|>I did nothing special and it works out of the
|>> box with smartftp and IE.
|>>
|>> My satellite office has a linksys befsr41 and windows 2000 ftp server.
|>>
|>> So to sum up what you are saying is browsing a ftp site via IE is not
|>possible with a cheepo linksys router?
|>
|>I've had it work fine with a BEFSR41 - however, the control channel needs to
|>be unencrypted, and the FTP server needs to be bound to port 21.
|>
|>Alun.
|>~~~~
|>

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages about iis ftp

iis ftp : How to configure the port range for passive FTP connection ?