Port 21 is open but I can't connect to FTP server

Question

I have a very basic FTP server running on Windows 10. Right now, I have no trouble accessing this server from my WLAN. However, when I try to connect from outside my network—using my public IP on port 21—I get an error message from Chrome, Windows Explorer, Mozzila, Filezilla, etc.

I’ve checked several times and port 21 is open using CanYouSeeme.org. Also, when I do a test on FTP test using my public IP on port 21 everything seems to be fine, I even get a directory listing of the files I currently have on the working directory.

What could be the issue?

Additional info: I added the rule for FTP on my firewall, but now firewall is turned off for both private and public networks.

Solution

I suspect you are using Active FTP. Active FTP requires that the client be able to listen on an incoming port. A service like CanYouSeeMe is probably configured to support this, automatically opening the incoming port when needed. However, if your client is behind NAT (that is different from your server's NAT) then the client will not be able to use Active FTP because the port that the client needs to listen on will not be forwarded from the NAT router.

To avoid this problem, you need to use Passive FTP. Passive FTP has the client initiate both connections. This means that the client doesn't need to mess around with incoming firewall rules or NAT port forwarding. However, it also means that you need to open at least two ports on the server side: the FTP command port (21) and one or more FTP data ports (which can be anything above 1024) and then tell the server to use those ports for data. These ports need to be both allowed in the firewall (when you have it enabled) and forwarded through the NAT (unless your server is running in the NAT DMZ, in which case all unexpected traffic is forwarded to it but you really should turn the firewall back on).

This page isn't the best explanation of active and passive FTP, but it does talk about configuring IIS for passive FTP so maybe it will help you: http://www.velikan.net/iis-passive-ftp/

Comments

[gemathus]

thanks a lot! I'll give it a shot tomorrow, but thanks a lot for your time. What you said seems to make a lot of sense.