Configuring Windows Firewall for FTP

I am having problems with a Windows 2003 computer getting ftp client to
work. Is there a specific recommendation on how to configure Windows
Firewall on the client computer for that case?

We are using a desktop GUI application that uses FTP to upload files. It
does NOT use the ftp command from the command line, but uses the ftp
protocol and its own built in code. I tried to add that application to the
Exceptions list in Windows Firewall, but that didn't help. The Security
Event viewer is showing a failure for the program SVCHOST.EXE, which is
quite odd since the client application is not a service. It is hard to
describe the failure snce the client application has a proprietary interface
and the error is specific to the application and not very descriptive. The
basic idea is that the ftp client is initiated, and shortly thereafter you
get a message from the client application that the host has reset and it
times out. The ftp server is up and I can connect to it manually from
other hosts without any problem.

--
Will

Forgot to add that I tried adding to the Exceptions list Port 21 UDP, Port
21 TCP, and Port 80 TCP, and none of those helped the ftp client to succeed.

Windows Firewall log shows the ftp server making a return connection to some
arbitrary ports on the client from port 80 on the ftp server (strange, I
thought were connecting to ftp, but looks like they are using the http
server port for their ftp server?).

--
Will


"Will" <westes-(E-Mail Removed)> wrote in message
news:(E-Mail Removed) ...
> I am having problems with a Windows 2003 computer getting ftp client to
> work. Is there a specific recommendation on how to configure Windows
> Firewall on the client computer for that case?
>
> We are using a desktop GUI application that uses FTP to upload files. It
> does NOT use the ftp command from the command line, but uses the ftp
> protocol and its own built in code. I tried to add that application to
the
> Exceptions list in Windows Firewall, but that didn't help. The Security
> Event viewer is showing a failure for the program SVCHOST.EXE, which is
> quite odd since the client application is not a service. It is hard to
> describe the failure snce the client application has a proprietary
interface
> and the error is specific to the application and not very descriptive.
The
> basic idea is that the ftp client is initiated, and shortly thereafter you
> get a message from the client application that the host has reset and it
> times out. The ftp server is up and I can connect to it manually from
> other hosts without any problem.
>
> --
> Will
>
>

Have you tried adding port 20 to your firewall too ?
Port 20 is the data port of FTP. 21 is just the control port.

As listed in the IANA Port Assignment:

ftp-data 20/tcp File Transfer [Default Data]
ftp-data 20/udp File Transfer [Default Data]
ftp 21/tcp File Transfer [Control]
ftp 21/udp File Transfer [Control]

Will wrote:
> Forgot to add that I tried adding to the Exceptions list Port 21 UDP, Port
> 21 TCP, and Port 80 TCP, and none of those helped the ftp client to succeed.
>
> Windows Firewall log shows the ftp server making a return connection to some
> arbitrary ports on the client from port 80 on the ftp server (strange, I
> thought were connecting to ftp, but looks like they are using the http
> server port for their ftp server?).
>
> --
> Will
>
>
> "Will" <westes-(E-Mail Removed)> wrote in message
> news:(E-Mail Removed) ...
> > I am having problems with a Windows 2003 computer getting ftp client to
> > work. Is there a specific recommendation on how to configure Windows
> > Firewall on the client computer for that case?
> >
> > We are using a desktop GUI application that uses FTP to upload files. It
> > does NOT use the ftp command from the command line, but uses the ftp
> > protocol and its own built in code. I tried to add that application to
> the
> > Exceptions list in Windows Firewall, but that didn't help. The Security
> > Event viewer is showing a failure for the program SVCHOST.EXE, which is
> > quite odd since the client application is not a service. It is hard to
> > describe the failure snce the client application has a proprietary
> interface
> > and the error is specific to the application and not very descriptive.
> The
> > basic idea is that the ftp client is initiated, and shortly thereafter you
> > get a message from the client application that the host has reset and it
> > times out. The ftp server is up and I can connect to it manually from
> > other hosts without any problem.
> >
> > --
> > Will
> >
> >

"John" <(E-Mail Removed)> wrote:

>Have you tried adding port 20 to your firewall too ?
>Port 20 is the data port of FTP. 21 is just the control port.
>
>As listed in the IANA Port Assignment:
>
>ftp-data 20/tcp File Transfer [Default Data]
>ftp-data 20/udp File Transfer [Default Data]
>ftp 21/tcp File Transfer [Control]
>ftp 21/udp File Transfer [Control]
>

Beside of that, a general comment:

Free tools like Sysinternals TCIPview or TDImon
may help to FIND out ports used by programs.

http://www.sysinternals.com/NetworkingUtilities.html

Olaf