FileZilla port forwarding

I have problems with FileZilla forwarding thru adsl NAT.

I have enabled passive mode (just a few users) with ports 65000-65005 (and 21, plain FTP), and also made portforwards for those ports.

However, the connection doesn't work that way? Did I forgot any other ports?

When I put server in DMZ, all works fine.

Pls. help! :)
mrmutAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dave BaldwinFixer of ProblemsCommented:
Plain FTP server uses port 20 for data transfer in 'normal' mode.  Did you set up the server for passive mode connections thru those ports?

From https://en.wikipedia.org/wiki/File_Transfer_Protocol 
In situations where the client is behind a firewall and unable to accept incoming TCP connections, passive mode may be used. In this mode, the client uses the control connection to send a PASV command to the server and then receives a server IP address and server port number from the server, which the client then uses to open a data connection from an arbitrary client port to the server IP address and server port number received.
mrmutAuthor Commented:
I forwarded ports 21, and 65000-65005 - I thought Passive mode is on as soon as I ebable that.

Port 20 should be for normal mode only? Or should I also port that through?
Dave BaldwinFixer of ProblemsCommented:
The client will request passive mode.  You have to tell the server what ports to use for passive mode so it knows what to tell the client to use.  Just opening them in the firewall isn't enough.  Port 20 is used in 'active mode', I don't know if it needs to be open for passive mode.
Your Guide to Achieving IT Business Success

The IT Service Excellence Tool Kit has best practices to keep your clients happy and business booming. Inside, you’ll find everything you need to increase client satisfaction and retention, become more competitive, and increase your overall success.

mrmutAuthor Commented:
Heh. I tried defining Passive mode ports + port 21, but for some reason, I can't connect to the server. It works only if I put it in DMZ, and I checked both the firewall and server settings. It should work.

Any testing idea? I am kind of lost here.
Dave BaldwinFixer of ProblemsCommented:
No, I don't know.  Please click on "Request Attention" above to get some others to look at your question.
gheistCommented:
When you say filezilla - is it client or server?
☠ MASQ ☠Commented:
How have you configured the Server Options within FileZilla?

In Passive Mode you can still limit the port range used (otherwise any port over 1024 could be selected) and you need to define your external (IPv4) IP - or if your external IP varies (DynDNS) allow FileZilla's servers to retrieve it.

For testing Port 21 try https://ftptest.net/ - you should at least get a log file showing what doesn't work!
mrmutAuthor Commented:
OK, so it is as follows:

FileZilla server

I have set up a user, shares, etc, with permissions, and all is ok in that area.

In settings I have listen on port 21, binded on all interfaces (*)

In passive Mode settins, I have set 65000-65005, and seet IPv4 IP setting set to retrieve external IP address from ip.filezilla-project.org

In security settings I have set "require matching peer IP address of control..."


All that set behind aDSL, with forwarded ports 65000-65005 and 21, and without setting server into DMZ, I can't get data connection pass through. The server connects, but it fails down on enumerating dir, transferring etc.

And I have checked port forwards at least 50 times if I made a mistake anywhere.
☠ MASQ ☠Commented:
Which router? - do you have hardware fire-walling?

Zilla recommend a larger port range so (at least for testing) could you up it to 65000-65050 (I know it shouldn't make a big difference but it's their product :))

Do you have a variable external IP?  If not try using the second option in the server config rather than relying on ip.filezilla

Are your users inside or outside the Server's LAN?  Where are you testing from?  Don't test from within the network unless you have no other option.
Davis McCarnOwnerCommented:
FTP is not file sharing. Which are you trying to make work?
And, is there perchance, a second router (i.e. Internet -> ADSL -> Dlink, Netgear, etc. -> server)?
gheistCommented:
Your setup will not allow ftp active mode, like windows ftp.exe
Can you share some server log of failing session?
mrmutAuthor Commented:
It is very simple: the login process passes fine, but the thing halts up on listing directories.
The logs are the same way from both sides (client-server), they both handshake well, but fall down just before listing directory:

Status:      Connection established, waiting for welcome message...
Status:      Connected
Status:      Retrieving directory listing...


And if I put the server in DMZ, it works fine. The weirdest part is that I have checked and rechecked port forwards gazillion times, and everythign is OK. I even have loads of experience with that particular modem.
gheistCommented:
Can you see commands in filezilla server log?
time out on listing means that data connection was not estabilished.
Davis McCarnOwnerCommented:
Again:
FTP is not file sharing. Which are you trying to make work?
 And, is there perchance, a second router (i.e. Internet -> ADSL -> Dlink, Netgear, etc. -> server)?
☠ MASQ ☠Commented:
What do you see with http://ip.filezilla-project.org/ip.php ??
If you're getting 127.0.0.1 you still don't have the external server setting correct for passive use.
John Gates, CISSPSecurity ProfessionalCommented:
Leave your general mode set to port :21

Under passive settings:
In your settings set custom port range to 45000 - 46000

Make sure your global address is listed in the IPv4 section of the settings.  From the server running the Filezilla open a web browser and go to www.whatismyip.com make sure that IP is the one listed.

THEN ON YOUR ROUTER
You should be port forwarding the following to your servers internal address:
Port(s) 20-22 TCP
Port(s) 45000-46000 TCP AND UDP

That's it.  I have 12 systems set up for various places and they all work. Hope this helps!

-J-

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
gheistCommented:
ftp uses UDP... yayaya...
mrmutAuthor Commented:
I am just testing, will open port from 20-22, and leave 65000-65005 (don't need more).

Re the 127.0.0.1 for IP address:

"The FileZilla IP page will return the correct IP only to FileZilla products. All other connectors, including browsers, see only 127.0.0.1. This is to prevent third-party abuse of that service."

Will report back, I need to test this thoroughly.
mrmutAuthor Commented:
OK, so I tried the new settings, and it still didn't work. Than I called telecom company and asked for line checkup and testing. It turned out, the line was problemmatic and needed repairs. Additionally, I asked for modem/router replacement, and got a new one.

After forwarding ports anew, as per recommentations by John Gates, it works nicely now. :-)
(Tho I only left 6 ports open, as per my needs.)
gheistCommented:
Filezilla client allows 9 parallel transfers... as per my needs.
mrmutAuthor Commented:
Agree, but I have closed source client application that used only one + have it on several locations. That makes even 6 a crowd, but I wanted to be on the safe side.

Thanks for help!
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Networking Protocols

From novice to tech pro — start learning today.