FTP service and Windows Firewall on Server 2003 -- iis ftp

iis ftp : FTP service and Windows Firewall on Server 2003

.._..
7/19/2007 1:57:42 PM

There is an IP address-based ACL in the "Security" tab that allows the
server to accept, or reject traffic from individual or blocks of IP
addresses.

Your description is consistent with it being that the originating IP is on
that list. So it's worth a check in there.

[quoted text, click to view]

Viktor Jevdokimov
7/19/2007 2:56:06 PM

Hi all,

Environment:
- Windws Server 2003 R2 Standard Edition Service Pack 2
- IIS with FTP service
- Windows Firewall enabled, TCP ports 21 and 20 are enabled both on
exceptions list and on connection.

Problem: "Connection closed by remote host." right after user name is
entered when connecting from outside.

When testing locally on the server or when Windows Firewall is disabled -
everything is fine, no problems. When Firewall is enabled, connection from
outside just drops right after user name is entered.

IIS log file shows 421 FTP status and 121 win32 status.

How to configure Windows Firewall properly for FTP service to work from
outside?

Thanks in advance,
Viktor

Viktor Jevdokimov
7/19/2007 5:45:13 PM

No IP restrictions. BTW, if IP is rejected, why it is starting an FTP
connection and asking for a user name? If IP is restricted, connection
should be dropped before FTP welcome line and user name prompt.

[quoted text, click to view]

Bernard Cheah [MVP]
7/23/2007 12:00:00 AM

ya. it checked for access ip before prompt for login.

do you have inetinfo.exe defined in the firewall exception list?

if you try ftp.exe command line to connect remotely, will it drop again
after you entered the user name or ?

--
Regards,
Bernard Cheah
http://www.iis.net/
http://msmvps.com/blogs/bernard/

[quoted text, click to view]

Viktor Jevdokimov
7/23/2007 1:29:57 PM

Have added inetinfo.exe to the Firewall - no changes.
Probably I need to try to reinstall SP2, since FTP service was added after
SP2 was installed.
BTW, locally with Firewall enabled, FTP works fine, while from external IP's
connection is dropped right after I entered user name.

[quoted text, click to view]

Deniz
7/23/2007 3:25:05 PM

[quoted text, click to view]

Hi,

Does your FTP client use passive mode? I was having similar problem,
and disabling the passive mode solved the case. IIS 6 FTP service does
not work properly in passive mode (high ports) while Windows Firewall
is enabled. Or you can try what Bernard says, use ftp command line
utility to see if you can connect, which doesn't send any PASV
commands to the server.

In my case, directory listing hangs at certain point when I use
passive mode. I tried whatever was suggested (defining passive mode
port range in Meta Base explorer and adding those ports to the Windows
Firewall) but nothing helped but using active mode. I hope this helps.

Deniz

Deniz

Viktor Jevdokimov
7/24/2007 12:00:00 AM

I've used commandline FTP and other clients. PASV mode is for transfer, when
you're logged in, but I can't login! Connection hangs just right after user
name is sent, server won't ask for password and this behaviour is just for
all external clients, while locally I can login without problem.
Reinstalling SP2 did fix the problem. Only disabling Windows Firewall can
help.

[quoted text, click to view]

Deniz
7/24/2007 11:09:17 AM

[quoted text, click to view]

Hi Viktor,

Incredibly, your small recipe solved my problem too.

I could never guess that unchecking the FTP service in firewall would
actually yield a better result. Oh well, we are learning new things
everyday thanks to MS ;)

Thanks very much!

Deniz

Viktor Jevdokimov
7/24/2007 3:43:21 PM

Problem solved:

1. Uncheck "FTP Server" in Windows Firewall Extended tab for every location
2. Add 21 port to exceptions

[quoted text, click to view]

Daniel Abbott
8/2/2007 1:33:20 PM

I am having the same problems.

Scenario:
Windows 2003 Server - firewalled on a Broadband DSL conn.
Can DOS FTP and Explorer FTP with no issues

Windows XP SP2 Workstation - Connected via LAN
Gets "Connection close by remote host" after entering username in DOS
FTP and "Windows cannot access this folder...The connection with the
server was reset."

If you have solved this issue, please detail the steps you took.

THANK YOU!!!!
Dan

Thierry Frache
8/2/2007 10:46:24 PM

Hi,

did you read this article http://support.microsoft.com/kb/283679 ? Most of
time, the problem is related to the ports which are not open to the Internet
(the ftp-data port). On Microsoft FTP sites, the dynamic port is choosen
between 1024 and 5000 which means you may have to open all theses ports.
With ISA Server, there is a filter (like an addon) which opens and closes
the ftp-data ports on demand. Try to open theses ports for a limited time
just to see what happens when you try again to connect to your ftp server.

Thierry

[quoted text, click to view]

Daniel Abbott
8/3/2007 6:53:14 AM

Thank you for the post, but my problem is on the other side of that
scenario. Our corp office has an FTP server. We are a remote office
with a DSL highspeed connection. If I connect directly to the DSL
modem, I can FTP through both DOS and Explorer. If I try the same thing
on the server directly, I get the same result, success. Yet, if I try
from any workstation on the domain, I get the error I've posted. HELP!!

Daniel Abbott
8/8/2007 1:14:04 PM

Found it. Stop the Application Layer Gateway service on the server.
That will fix the issue almost instantly. This was posted on a TechNet
news posting under "XP clients ftp".

Dan

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages about iis ftp

home · blog · groups

Questions? Comments? Contact the dn