How to Configure firewall in FTP

[Elijah2010]

Hi all,

I am using FTP for file sharing in my office. I have much more secure file for office use. I do not want to any hackers can hack mu files. So i want to put firewall between FTP. Please suggest me how to Configure firewall in FTP. Thanks in advance.

[Steve123]

You can consider the following things for Configure firewall in FTP :

1. Internal network address of the NAT for the external network can access the address;
2. FTP services are typically TCP21 port Host link;
3. FTP is divided into PASV and PORT in two ways, namely, the passive mode and active mode. In the PASV, when the client and FTP server data transfer process took place, the use of more than 1024 dynamic port with the server link, while the PORT mode, only with the server to TCP20 port to communicate. These two methods initiated by the client when the freedom of choice.

[Shen]

You can not restrict the client to use PORT only way data exchange with FTP server, then open the ports above 1024, for security, after all, will cause a certain degree of security of hidden paralysis. Such as open: 1025,1433,3389,5000,9995,9996 and so on, may give rise to the internal network problems. If the 11 set, for efficiency in the firewall, etc., but also had to consider. reply if you need more information.

[Big Fish]

FTP server with Serv-U5.0.11, but this FTP server provides a PASV port range setting, this way you can make a relatively simple and relatively stable settings.
Program:
1. Static port address mapping, allowing users to external network address + port 21 to access the network within a specific FTP service;
2. Set the firewall ACL, Xu charge users to access FTP server via TCP port 6800-6900;
3. Serv-U to set the PASV: Management - local server --- Settings - Advanced Settings, in the Server column, set the PASV prots range of 6800-6900
4. Enable the setting.

[Zachary]

FTP services are not like other servers, such as the DNS to use only UDP53 port, EMAIL only use TCP 110 and 25 ports, WEB using TCP80 port, TFTP port 69 using UDP because of its passive mode, the server must provide a certain degree of higher 1024 port for the client. At the same time, you have no way to only require users to use only the active mode, because the user may not be aware of this, many FTP clients default is to use passive mode. Because, if the firewall is only open ports 20,21 will cause the client can be user authentication, but not listed, can not carry out data transmission, and prompt, "You do not have permission" This kind of 550 returns an error. Best of luck.