What ports to open in server firewall?

To the Ipswitch web site

Ipswitch Forums
Home      Members   Calendar   Who's On
Welcome Guest ( Login | Register )
      



What ports to open in server firewall?Expand / Collapse
Author
Message
Posted 12/19/2008 1:03:07 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 12/19/2008 1:56:14 PM
Posts: 9, Visits: 25
I've got WS_FTP server installed on a machine in our DMZ, and have been struggling for a really long time trying to get the site to actually function. I have a listener setup on port 990, using implicit SSL, with both TLS and SSL 1, 2 and 3 enabled. No minimum SSL level, CCC disallowed, SSL forced and SSL forced on data channel.

The client machine is running FileZilla and has no firewall.

And I cannot get it to work. As of now, I'm up to the point of being able to hit the site, and login. When I get to the point of sending LIST, things stop working.  The error seems to depend on which ports are opened on the server.

With 990 open inbound and outbound, and 20 open outbound, LIST churns until it hits whatever value I give FileZilla as the timeout setting, and then returns a timeout error. The WS_FTP log shows a failure because 'the connected party did not properly respond after a period of time, or established connection failed because host has failed to respond.'

With 990 open inbound and outbound, and 989 open outbound (suggested by WS_FTP support as being the way to do things with implicit SSL), LIST errors out quickly - the log shows a failure due to the target machine actively refusing it.

I've also tried 990 open inbound and outbound, and ports > 1024 open outbound - also a quick failure due to target machine refusing it.

I've also played around sending some raw commands to the server. While I can make directories to my heart's content, LIST and STOR - which are the commands that are actually of use to me - fail.

I've been back and forth with WS_FTP support on this for several months. Each time I get a slightly different suggestion for which ports need to be opened. None have worked. So, anyone out there have any experience in dealing with this sort of thing, who might have some ideas?

Post #49670
Posted 12/19/2008 1:35:16 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 12/19/2008 1:56:14 PM
Posts: 9, Visits: 25
On the off chance this may spark something in anyone's head, here's the log entries for two LIST attemps. The first with 990 in/out 20 out, the second with 990 in/out 989 out:

<?xml version="1.0" encoding="utf-8" ?>
<log>
 

  <entry>
    <log_time>20081219-08:21:21</log_time>
    <description><![CDATA[Connection established]]></description>
    <service>FTP</service>
    <sessionid>04032828</sessionid>
    <type>0</type>    <severity>0</severity>
    <lstnconnaddr>192.168.50.19:990</lstnconnaddr>
    <cliconnaddr>12.64.152.87:2371</cliconnaddr>
    <cmd>start</cmd>
    <sguid>28C90A6E-42C0-41DB-2C96-33EF5BC01106</sguid>
  </entry>

  <entry>
    <log_time>20081219-08:21:25</log_time>
    <description><![CDATA[SSL version info: version=TLSv1/SSLv3:cipher=AES128-SHA:strength=128]]></description>
    <service>FTP/SSL</service>
    <sessionid>04032828</sessionid>
    <type>0</type>    <severity>0</severity>
    <user>admin</user>
    <host>192.168.50.19</host>
    <lstnconnaddr>192.168.50.19:990</lstnconnaddr>
    <cliconnaddr>12.64.152.87:2371</cliconnaddr>
    <cmd>USER</cmd>
    <params><![CDATA[admin]]></params>
    <sguid>28C90A6E-42C0-41DB-2C96-33EF5BC01106</sguid>
  </entry>

  <entry>
    <log_time>20081219-08:21:26</log_time>
    <description><![CDATA[logon success (admin)]]></description>
    <service>FTP/SSL</service>
    <sessionid>04032828</sessionid>
    <type>1</type>    <severity>1</severity>
    <user>admin</user>
    <host>192.168.50.19</host>
    <lstnconnaddr>192.168.50.19:990</lstnconnaddr>
    <cliconnaddr>12.64.152.87:2371</cliconnaddr>
    <cmd>PASS</cmd>
    <params><![CDATA[*****]]></params>
    <errnum>220</errnum>
    <sguid>28C90A6E-42C0-41DB-2C96-33EF5BC01106</sguid>
  </entry>

  <entry>
    <log_time>20081219-08:21:53</log_time>
    <description><![CDATA[socket exception A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 12.64.152.87:6452,    at System.Net.Sockets.Socket.EndConnect(IAsyncResult asyncResult)
   at SSHServerAPI.Transport.FTPTransport._OnDCConnect(IAsyncResult ar)]]></description>
    <service>FTP/SSL</service>
    <sessionid>04032828</sessionid>
    <type>4</type>    <severity>3</severity>
    <user>admin</user>
    <host>192.168.50.19</host>
    <lstnconnaddr>192.168.50.19:990</lstnconnaddr>
    <cliconnaddr>12.64.152.87:2371</cliconnaddr>
    <cmd>LIST</cmd>
    <errnum>10060</errnum>
    <sguid>28C90A6E-42C0-41DB-2C96-33EF5BC01106</sguid>
  </entry>

  <entry>
    <log_time>20081219-12:40:29</log_time>
    <description><![CDATA[Connection established]]></description>
    <service>FTPS</service>
    <sessionid>33711845</sessionid>
    <type>0</type>    <severity>0</severity>
    <lstnconnaddr>192.168.50.19:990</lstnconnaddr>
    <cliconnaddr>12.65.114.115:4134</cliconnaddr>
    <cmd>start</cmd>
    <sguid>28C90A6E-42C0-41DB-2C96-33EF5BC01106</sguid>
  </entry>

  <entry>
    <log_time>20081219-12:40:29</log_time>
    <description><![CDATA[SSL version info: version=TLSv1/SSLv3:cipher=AES128-SHA:strength=128]]></description>
    <service>FTPS</service>
    <sessionid>33711845</sessionid>
    <type>0</type>    <severity>0</severity>
    <user>admin</user>
    <host>192.168.50.19</host>
    <lstnconnaddr>192.168.50.19:990</lstnconnaddr>
    <cliconnaddr>12.65.114.115:4134</cliconnaddr>
    <cmd>USER</cmd>
    <params><![CDATA[admin]]></params>
    <sguid>28C90A6E-42C0-41DB-2C96-33EF5BC01106</sguid>
  </entry>

  <entry>
    <log_time>20081219-12:40:29</log_time>
    <description><![CDATA[logon success (admin)]]></description>
    <service>FTPS</service>
    <sessionid>33711845</sessionid>
    <type>1</type>    <severity>1</severity>
    <user>admin</user>
    <host>192.168.50.19</host>
    <lstnconnaddr>192.168.50.19:990</lstnconnaddr>
    <cliconnaddr>12.65.114.115:4134</cliconnaddr>
    <cmd>PASS</cmd>
    <params><![CDATA[*****]]></params>
    <errnum>220</errnum>
    <sguid>28C90A6E-42C0-41DB-2C96-33EF5BC01106</sguid>
  </entry>

  <entry>
    <log_time>20081219-12:40:32</log_time>
    <description><![CDATA[socket exception No connection could be made because the target machine actively refused it 12.65.114.115:6278,    at System.Net.Sockets.Socket.EndConnect(IAsyncResult asyncResult)
   at SSHServerAPI.Transport.FTPTransport._OnDCConnect(IAsyncResult ar)]]></description>
    <service>FTPS</service>
    <sessionid>33711845</sessionid>
    <type>4</type>    <severity>3</severity>
    <user>admin</user>
    <host>192.168.50.19</host>
    <lstnconnaddr>192.168.50.19:990</lstnconnaddr>
    <cliconnaddr>12.65.114.115:4134</cliconnaddr>
    <cmd>LIST</cmd>
    <errnum>10061</errnum>
    <sguid>28C90A6E-42C0-41DB-2C96-33EF5BC01106</sguid>
  </entry>

</log>

Post #49672
Posted 12/23/2008 9:56:13 AM


Time Traveler

Time TravelerTime TravelerTime TravelerTime TravelerTime TravelerTime TravelerTime TravelerTime Traveler

Group: Forum Administrators
Last Login: 3/5/2013 11:13:21 AM
Posts: 239, Visits: 851
Try opening 1024-1050 inbound from your hardware firewall then set your firewall options in WS_FTP Server to use the same port range. You should not need an IP under the Firewall - Passive connection settings.

Travis G.
Ipswitch, Inc.
Post #49756
« Prev Topic | Next Topic »


Reading This TopicExpand / Collapse
Active Users: 0 (0 guests, 0 members, 0 anonymous members)
No members currently viewing this topic.
Forum Moderators: Dave, Mark Singh, kevin r gillis, Tripp Allen, NothingToSeeHere, Jason Williams, Hush, FTPplanet.com, LDW, Hugh Garber, WUP-PM, mmulryan@ipswitch.com, mswimm, Travis G.

PermissionsExpand / Collapse

All times are GMT -5:00, Time now is 9:04pm

Powered By InstantForum.NET v4.1.4 © 2013
Execution: 1.250. 8 queries. Compression Enabled.