Windows Server 2003 Blocking Outgoing FTP Port Above 42000
I have two machines behind the same firewall/router - one is a Windows 7 workstation and the other is a Windows 2003 server. The problem is with
outgoing FTP access using a FileZilla FTP client (note: not FileZilla server) on the Windows 2003 server.
Using FileZilla client on the Win7 workstation I am able to connect to a specific external FTP site using passive mode without issue. However, when I try the same thing from FileZilla client on the Windows 2003 server it hangs when attempting to retrieve
the directory list. The log output is as follows:
Status: Resolving address of xxxxx.com
Status: Connecting to xxx.xxx.xxx.xxx:21...
Status: Connection established, waiting for welcome message...
Response: 220---------- Welcome to ...
Command: USER ...
Response: 331 User ... OK. Password required
Command: PASS *************
Response: 230 OK. Current directory is /
Command: SYST
Response: 215 UNIX Type: L8
Command: FEAT
Response: 211-Extensions supported:
Response: EPRT
Response: IDLE
Response: MDTM
Response: SIZE
Response: REST STREAM
Response: MLST type*;size*;sizd*;modify*;UNIX.mode*;UNIX.uid*;UNIX.gid*;unique*;
Response: MLSD
Response: ESTP
Response: PASV
Response: EPSV
Response: SPSV
Response: 211 End.
Status: Connected
Status: Retrieving directory listing...
Command: PWD
Response: 257 "/" is your current location
Command: TYPE I
Response: 200 TYPE is now 8-bit binary
Command: PASV
Response: 227 Entering Passive Mode (xxx,xxx,xxx,xxx,164,24)
Command: MLSD
Error: Connection timed out
Error: Failed to retrieve directory listing
As you can see, a connection over port 21 is established and a request to enter passive mode results in port 42008 being established. But the attempt to retrieve data over that port fails. This works flawlessly on the Win7 machine which indicates the firewall
they share is not the problem.
I have also discovered that this is specific to one FTP site that I use, mostly because the passive port returned from that server is over 42000. For two other site that I connect to from the Win2003 box the passive ports are under 5000 and FileZilla connects
without issue.
It appears in this case that Windows Server 2003 is blocking traffic on certain ports. The Windows Firewall service isn't running on this device so I can eliminate that as the culprit.
I ran across and tried this KB article (support.microsoft.com/kb/196271) that outlined the a problem using outbound ports > 5000 on Win2003. I added
the registry key, but it doesn't appear to correct the issue. Still, this would appears to be exactly the cause of the problem. Strange.
I've tried WireShark and it shows the packet trying to get to the FTP server over the specified port, but no response is received.
All suggestions welcome.
Bob Mc.
April 9th, 2011 3:59pm
failed to retrieve directory listing shows me you are making a connection on that port. If it were not, you would get an ECONNABORTED message. So what this looks more like is that your connection strong does not match what it is set up for on the hosting
server. Check that out first.
*a
Free Windows Admin Tool Kit Click here and download it now
April 19th, 2011 1:14pm
Alex,
Thanks for the reply.
Interesting analysis. I was unaware of the ECONNABORTED message. However, I'm not sure what you mean by "connection string". If you mean the credentials, as you can see from the log I posted I receive "Response: 230 OK. Current directory is /"
after sending the user name and password. Since I'm validated at that point, what connection string doesn't match?
Bob Mc.
May 2nd, 2011 2:30pm
Further information:
I am no longer certain that ports are being blocked. I wrote a socket listener program running on a Win7 workstation that listens on port 52000. Then from the Win2003 server I telnet into the workstation using the address and port, and the program responds.
So the Win2003 box can clearly communicate within the same LAN over ephemeral ports.
Strange,
Bob Mc.
Free Windows Admin Tool Kit Click here and download it now
May 2nd, 2011 2:32pm
Bob, I mean that there are additional variables that need to be set. They are: username, password, is it FTP, FTPS, SFTP, what is the home directory and do you have access to the virtual or physical folder specified for you.
Needless to say, this is not a Windows issue. This is due to the program running the FTP service.
I'd be happy to help with that too. Let me know if you can elaborate on that front.*a
May 2nd, 2011 3:26pm
Alex,
It's plain old FTP.
Yes I have validated access to the home directory because I can connect just fine using the same credentials from a Win7 workstation running the same FTP client software (FileZilla) same ISP, same firewall, etc. The only difference is one computer is running
Win7 and one computer is running Win2003.
So since I can connect, download a file listing, upload and download files, delete files, and perform all FTP functions from the Win7 computer I have deduced that the problem is a configuration setting, or something related, on the Win2003 computer.
Thanks for helping, Alex. Much appreciated. All other suggestions welcome.
Bob Mc.
Free Windows Admin Tool Kit Click here and download it now
May 2nd, 2011 3:41pm
Bob, I am still convinved its an application issue with the FTP software. We can take this offline if you'd like. And allow others to respond to this thread, and see if they have an experience or opinion that may differ from mine.
Regards,*a
May 2nd, 2011 3:50pm
That's fine with me. How do we take this offline?
I'm not ruling out a problem with the FTP software, either client or server. I'm not ruling out
anything at this point. It just seems unlikely based on what I'm seeing.
Thanks again,
Bob Mc.
Free Windows Admin Tool Kit Click here and download it now
May 2nd, 2011 4:19pm
Alex,
I appears you may have been correct. I had some back-and-forth with the server admin, and he modified something and/or rebooted the server and, voilá, everything started working. Grrrrrr! Pulled my hair out for weeks and it may not have been a problem
on my side at all.
Thanks,
Bob Mc.
May 3rd, 2011 2:25pm
I am happy to hear it. Glad our chats helped.
Regards.*a
Free Windows Admin Tool Kit Click here and download it now
May 3rd, 2011 3:16pm