Member Avatar for amyn

Hi,
I installed Windows 2003, standard edition. I have a DSL connection, which is shared on my Windows 2003 through ICS. When i try to connect to a FTP Site, e.g. , it wouldn't let me. I have the windows firewall disabled. I transfered the DSL to a Windows XP system, and now i can connect to FTP Sites from any computer on the network. But when i use ICS from the windows 2003 computer, no computer on the network could connect to any FTP Sites. There is no domain, all computer are workstations.
Please help me out!!

  • 2 Contributors
  • 2 Replies
  • 129 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by gemini4

Dani AI

Generated

Simple cause and quick fixes

FTP uses a control channel (port 21) plus a separate data channel that can use port 20 or a dynamic port range. A simple port-forward of 20/21 often is not enough because the NAT has to rewrite PORT commands or allow outbound data connections. That explains why a different ICS/NAT implementation behaves differently. is on the right track: on Server 2003 you should use RRAS/NAT instead of relying on the simple ICS mechanism found on workstations.

What to try first (fast test)

  • Configure your FTP client to use passive (PASV) mode. Passive mode avoids incoming connections to the client and usually works through most NATs.
  • From an internal machine test the control connection with: telnet ftp.microsoft.com 21 to confirm the server greeting.
    If passive works, you have an easy fix: set all clients to use PASV.

If the 2003 box must be the gateway

  • Remove/disable ICS and enable Routing and Remote Access (RRAS) on the Server 2003 host. Use the RRAS wizard and choose NAT (Network Address Translation) with the internet-facing NIC set as the public interface. RRAS is the supported server-grade NAT and handles FTP scenarios far better.
  • If you are hosting an FTP server behind the NAT, configure the server to use a fixed passive port range, forward port 21 plus that passive range on the RRAS NAT, and make the server advertise the public IP for PASV responses.

Short troubleshooting checklist

  • Confirm no firewall on the gateway or server is blocking 21 or the passive range.
  • Test with netstat -an to see connections.
  • If active-mode FTP is required and RRAS is not acceptable, consider using a small hardware router or a dedicated FTP proxy that has an FTP application-level gateway.

Recommended Answers

All 2 Replies

Member Avatar for amyn

i shifted the ICS to a computer using WindowsXP, and i stopped the Firewall/ICS service on my windows 2003 workstation. Now the ftp is connecting perfectly fine. But i need to be connected to the internet directly, and other systems should connect through mine. What should i do to let access to FTP sites?

Member Avatar for gemini4

Did you install the Routing and Remote Access services on your 2003? In RRAS you can setup Network Adress Translation to redirect ports 20 and 21.

The problem was that you were connecting through ICS and not through NAT.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.