asked on

External FTP access on custom port

I am trying to set up FTP access for external users. Naturally, I don't want to open Port 21 to the outside world so I began by creating a firewall rule to forward a custom port 2100 to the server, translating it to 21. When that failed I changed the listening port in IIS to 2100. Internally I can access the FTP no problem with:
ftp://server:2100
When I try to access externally however I get a timeout.
If I change the listening port on the server (and the firewall rule) to 21 it works.
When I have everything set to 2100 I'm getting to the server- but this is what I get in the FTP log:

15:14:34 173.15.202.187 [17]USER receptionist 331 0
15:14:34 173.15.202.187 [17]PASS - 230 0
15:14:34 173.15.202.187 [17]CWD / 250 0

So- what else do I need to change to allow the custom port?

Jaroslav Mraz

Firewall in server and try pasiv mode in client

STS-Tech

ASKER

Firewall is disabled on server- but I added an exclusion for port 2100 just to be on the safe side. Passive mode was already enabled in IE, but tried turning it off- same result. Also tried opening in Windows Explorer- same thing.

STS-Tech

ASKER

I'm using the following to connect:
ftp://'ipaddress':2100/

Should I be doing something different?

ASKER CERTIFIED SOLUTION

Jaroslav Mraz

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

STS-Tech

ASKER

Results from Filezilla:

Response:      230 User receptionist logged in.
Command:      SYST
Response:      215 Windows_NT
Command:      FEAT
Response:      211-Extended features supported:
Response:       SIZE
Response:       MDTM
Response:      211 END
Status:      Server does not support non-ASCII characters.
Status:      Connected
Status:      Retrieving directory listing...
Command:      PWD
Response:      257 "/" is current directory.
Command:      TYPE I
Response:      200 Type set to I.
Command:      PASV
Response:      227 Entering Passive Mode (192,168,10,2,199,48).
Status:      Server sent passive reply with unroutable address. Using server address instead.
Command:      LIST
Response:      425 Can't open data connection.
Error:      Failed to retrieve directory listing

STS-Tech

ASKER

"Fixed" it. Installed Filezilla server, this allowed me to set a range of ports to be used by passive mode. Added those ports to the Custom FTP service in the firewall and I'm in. Not really a true fix as I'd rather use IIS, but the results are the same for the end users.

Thanks for pointing me in the right direction with FZ!