Firewall configuration for FTP using SOHO
Discussion
Port 21 on the router needs mapping to the port 21 on the machine thats running the FTP server as a static route.
Assuming your ISP allow traffic on 21.
Then if you have windows firewall setup and active you have to allow FTP Services over over the Windows firewall on the target machine.
It should then work...
Assuming your ISP allow traffic on 21.
Then if you have windows firewall setup and active you have to allow FTP Services over over the Windows firewall on the target machine.
It should then work...
Plotloss said:
Port 21 on the router needs mapping to the port 21 on the machine thats running the FTP server as a static route.
Assuming your ISP allow traffic on 21.
Then if you have windows firewall setup and active you have to allow FTP Services over over the Windows firewall on the target machine.
It should then work...
Not necessarily. The problem with ftp is that it uses two ports, one of which is established from the server to the client on a non-well-known port (one over 1000), which changes each time, making static firewall configs difficult.
This article explains how it works and what to do about it;
www.unixcities.com/ftp-and-firewall/
Plotloss said:
What I posted above is exactly what I did on my home network and it works fine.
And what I posted is entirely correct. It isn't necessarily the case that allowing port 21 through will fix ftp problems, unless you run all ftp connections in passive ("mode PASV"
mode. The article describes this. (BTW, what you describe is called "port forwarding", not a "static route", which is nothing to do with firewalls.)
>> Edited by zumbruk on Thursday 2nd February 16:15
zumbruk said:
What I posted above is exactly what I did on my home network and it works fine.
And what I posted is entirely correct. It isn't necessarily the case that allowing port 21 through will fix ftp problems, unless you run all ftp connections in passive ("mode PASV"
(BTW, what you describe is called "port forwarding", not a "static route", which is nothing to do with firewalls.)
>> Edited by zumbruk on Thursday 2nd February 16:15
Okay, thanks for all the info.
Looks like I'm knackered then, as I have no control over the FTP server!
Plotloss said:
What I posted above is exactly what I did on my home network and it works fine.
do you allow everything outbound as that would work. Also some firewalls have ftp proxies which watch the client server conversation and open the appropriate ports on the fly and then close them down when done
zumbruk said:
What I posted above is exactly what I did on my home network and it works fine.
And what I posted is entirely correct. It isn't necessarily the case that allowing port 21 through will fix ftp problems, unless you run all ftp connections in passive ("mode PASV"
(BTW, what you describe is called "port forwarding", not a "static route", which is nothing to do with firewalls.)
>> Edited by zumbruk on Thursday 2nd February 16:15
Port forwarding can be a dynamic or static route, depending on how the router is controlled.
Most SOHO routers are routers and firewalls in one, that was what I was meaning by firewall rather than the specific port control hardware/software that is a firewall.
Plotloss said:
What I posted above is exactly what I did on my home network and it works fine.
And what I posted is entirely correct. It isn't necessarily the case that allowing port 21 through will fix ftp problems, unless you run all ftp connections in passive ("mode PASV"
(BTW, what you describe is called "port forwarding", not a "static route", which is nothing to do with firewalls.)
Port forwarding can be a dynamic or static route, depending on how the router is controlled.
Port forwarding is nothing to do with routing. At all. Ever.
(I'm not getting at you - it's just that if people don't use the correct terminology the questions are hard to answer or the answers incomprehensible.)
Plotloss said:
Most SOHO routers are routers and firewalls in one, that was what I was meaning by firewall rather than the specific port control hardware/software that is a firewall.
Well, a firewall is a router with attitude ...
schueymcfee said:
What I posted above is exactly what I did on my home network and it works fine.
And what I posted is entirely correct. It isn't necessarily the case that allowing port 21 through will fix ftp problems, unless you run all ftp connections in passive ("mode PASV"
(BTW, what you describe is called "port forwarding", not a "static route", which is nothing to do with firewalls.)
>> Edited by zumbruk on Thursday 2nd February 16:15
Okay, thanks for all the info.
Looks like I'm knackered then, as I have no control over the FTP server!
Not at all. Your clients just need to use passive mode ("mode pasv"
.Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff