425 Can't open data connection for transfer of “/”

Question

I'm trying to solve this error searching the web, without any success.

The error is:

425 Can't open data connection for transfer of "/"

My software:

• Windows server 2013 and last filezilla server

My topology:

• Server wired to router - Router with a dynamic IP from ISP, dynamic dns updated.

My settings:

• PASV mode with ports 51000-61000
• Retrieve external ip with http://ip.filezilla-project.org/ip.php
• Enabled FTP over TLS with port 990

Where I opened my ports

• router: local and public 21, local 51000 public 51000-61000, local and public 990 (ALL tcp)
• Windows Firewall: both directions, ports 21, 51000-61000, 990.

On my lan it works perfectly. I think there's something wrong with router port forwarding configuration. Here it is.

My port forwarding configuration on router

Is there something I'm doing wrong?

I add a log of my ftp server:

(000013)06/11/2017 21:50:57 - user (my.ip.add.ress)> PBSZ 0
(000013)06/11/2017 21:50:57 - user (my.ip.add.ress)> 200 PBSZ=0
(000013)06/11/2017 21:50:57 - user (my.ip.add.ress)> PROT P
(000013)06/11/2017 21:50:57 - user (my.ip.add.ress)> 200 Protection level set to P
(000013)06/11/2017 21:50:57 - user (my.ip.add.ress)> PWD
(000013)06/11/2017 21:50:57 - user (my.ip.add.ress)> 257 "/" is current directory.
(000013)06/11/2017 21:50:57 - user (my.ip.add.ress)> TYPE I
(000013)06/11/2017 21:50:57 - user (my.ip.add.ress)> 200 Type set to I
(000013)06/11/2017 21:50:57 - user (my.ip.add.ress)> PASV
(000013)06/11/2017 21:50:57 - user (my.ip.add.ress)> 227 Entering Passive Mode (my,ip,addr,ess,205,93)
(000013)06/11/2017 21:50:57 - user (my.ip.add.ress)> MLSD
(000013)06/11/2017 21:51:07 - user (my.ip.add.ress)> 425 Can't open data connection for transfer of "/"

I add the ftp server configuration screens too just in case.

General Settings

PASV Mode settings

FTP over TLS

Solution

The router mapping seems suspicious, as you have correctly guessed. It looks like you have all public ports in range 51000-61000 mapped to a single internal port 51000. What would explain, why the client is not able to connect to port 52573.

If your router is not able to map a range of internal ports, you can configure your FTP server to use only a narrow range (like 51000-51010) and configure those ports one-by-one.

See also How many data channel ports do I need for an FTPS server running behind NAT?

Comments

[Martin Prikryl]

What is the error from client-side? What client are you using? Does the my,ip,addr,ess in the 227 response match the IP that the client is connecting to?

[Raikoug]

Remote client and server have the same error. my,ip,addr,ess is the correct one.

[Martin Prikryl]

Well, the router mapping seems suspicious, as you have correctly guessed. It looks like you have all public ports in range 51000-61000 mapped to a single internal port 51000. What would explain, why the client is not able to connect to port 52573.

[Raikoug]

Well I guess I have few choices: 1) Change router (very hard one, since is ISP provided). --- 2) I have a DMZ option to bypass any port forwarding to my server. Very dangerous I think. --- 3) SFTP, I think all trafic just pass from port 22 or the custom 1 i chose..

[Martin Prikryl]

If your router is not able to map a range of internal ports, you can configure your FTP server to use only a narrow range (like 51000-51010) and configure those ports one-by-one.