Member Avatar for leonlr78

Good day
I created a FTP server and want people from outside the company to be able to access it. Problem is that I don't know what IP or changes to make for it to work. Here is my breakdown.

Installed Windows server 2008 R2 and IIS7. Created an FTP website with IP address of (Static IP for internal network) and server name VANSYSTEMS. I'm able to FTP to the website via IE with or

However, from outside, this does not work, as it does not know about our internal IP ranges etc. I asked our Firewall guys to route all FTP traffic from our external IP address that is to this IP address 10.5.6.64. They done that, but I still cannot get to this website. I think I may also type the address wrong maybe. They said I must use my internal IP address, but that does not work, and cannot see that being true. I must have some route to me domain name that is vanchem.co.za. So my thoughts of the address should be like or maybe

Either way, none of it works and does not find the FTP website.

Any ideas

  • 4 Contributors
  • 3 Replies
  • 238 Views
  • 6 Days Discussion Span
  • Latest Post Latest Post by Ritesh_4

Dani AI

Generated

opened a good thread — the missing pieces aren’t IIS vs. internal IP so much as NAT + PASV + DNS + security. This note pulls those items together and expands on points made by , and with practical steps and troubleshooting checks.

  • DNS: create an A record such as ftp.vanchem.co.za pointing to the public address (196.15.160.106). Do not try to invent a hostname by embedding the internal IP (e.g. 10.5.6.64.vanchem.co.za). For internal users, use split-horizon DNS or hairpin NAT so the same name resolves correctly inside the LAN.
  • IIS Passive mode: configure a limited passive port range on the IIS FTP site (for example 50000–50100) and set the server to advertise the external/public IP in the FTP firewall/passive settings.
  • Perimeter device: the edge firewall/router must NAT (port-forward) TCP/21 and that passive range to 10.5.6.64. Either let the firewall’s FTP ALG rewrite PASV responses, or disable ALG and have IIS advertise the external IP — avoid double-rewrites.
  • Host firewall: open TCP/21 and the chosen passive range in Windows Firewall and ensure the FTP site is bound correctly.

Quick tests and diagnostics:

telnet 196.15.160.106 21

A control-banner confirms port 21 reaches the server. If login/banners work but transfers fail, the passive ports are not forwarded or the PASV reply contains a private IP (check IIS FTP logs).

Security and operational notes: prefer FTPS or SFTP over plain FTP; require TLS for credentials, disable anonymous access, lock users to their directories, use strong passwords and monitoring, and keep the server patched. Coordinate the passive-port range and DNS changes with the network/firewall team so NAT, firewall rules, and server settings all match.

Recommended Answers

All 3 Replies

Member Avatar for rubberman

The IP address you gave it is a non-routable (outside of your LAN) address. You can either poke a hole in your router/firewall to allow FTP requests to be routed to that system, or you can configure the router put it in a DMZ (open to the world). Does your company have an IT department that handles such things? You might also need to get executive approval to breach the firewall this way. Finally, make sure you have a a fully patched and up-to-date ftp server, and keep it patched, as these are prime infection vectors for malware and hackers.

Member Avatar for sarabjeet singh

But once you open the port for global access the Security will be the biggest concern, so do check it with your Network Tech. You need to put exception for limited ports and should have high end security software.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.