Recommended Posts

Hi.

I am setting up an FTPS server using FileZilla on a Server 2008 R2 VM but I am struggling to get the directory listings up.

I have created the certificate and key password and it imports without any problem into FileZilla (client) but I get the log below

Status: Connection established, initializing TLS...

Status: Verifying certificate...

Status: TLS/SSL connection established, waiting for welcome message...

Response: 220-FileZilla Server version 0.9.41 beta

Response: 220 Welcome to The Swann Group download site.

Command: USER JasonW

Response: 331 Password required for jasonw

Command: PASS *********

Response: 230 Logged on

Command: PBSZ 0

Response: 200 PBSZ=0

Command: PROT P

Response: 200 Protection level set to P

Status: Connected

Status: Retrieving directory listing...

Command: PWD

Response: 257 "/" is current directory.

Command: TYPE I

Response: 200 Type set to I

Command: PORT 84,21,143,150,192,13

Response: 200 Port command successful

Command: MLSD

Response: 150 Opening data channel for directory list.

Response: 425 Can't open data connection.

Error: Failed to retrieve directory listing

Response: 421 Connection timed out.

Error: Connection closed by server

And from the server I get,

(000036)18/12/2012 13:36:49 - (not logged in) (
84.21.**.**
)> Connected, sending welcome message...

(000036)18/12/2012 13:36:49 - (not logged in) (
84.21.**.**
)> SSL connection established

(000036)18/12/2012 13:36:49 - (not logged in) (
84.21.**.**
)> USER JasonW

(000036)18/12/2012 13:36:49 - (not logged in) (
84.21.**.**
)> 331 Password required for jasonw

(000036)18/12/2012 13:36:49 - (not logged in) (
84.21.**.**
)> PASS *********

(000036)18/12/2012 13:36:49 - jasonw (
84.21.**.**
)> 230 Logged on

(000036)18/12/2012 13:36:49 - jasonw (
84.21.**.**
)> PBSZ 0

(000036)18/12/2012 13:36:49 - jasonw (
84.21.**.**
)> 200 PBSZ=0

(000036)18/12/2012 13:36:50 - jasonw (
84.21.**.**
)> PROT P

(000036)18/12/2012 13:36:50 - jasonw (
84.21.**.**
)> 200 Protection level set to P

(000036)18/12/2012 13:36:50 - jasonw (
84.21.**.**
)> PWD

(000036)18/12/2012 13:36:50 - jasonw (
84.21.**.**
)> 257 "/" is current directory.

(000036)18/12/2012 13:36:51 - jasonw (
84.21.**.**
)> TYPE I

(000036)18/12/2012 13:36:51 - jasonw (
84.21.**.**
)> 200 Type set to I

(000036)18/12/2012 13:36:51 - jasonw (
84.21.**.**
)> PORT 84,21,143,150,192,13

(000036)18/12/2012 13:36:51 - jasonw (
84.21.**.**
)> 200 Port command successful

(000036)18/12/2012 13:36:51 - jasonw (
84.21.**.**
)> MLSD

(000036)18/12/2012 13:36:51 - jasonw (
84.21.**.**
)> 150 Opening data channel for directory list.

(000036)18/12/2012 13:37:01 - jasonw (
84.21.**.**
)> 425 Can't open data connection.

(000036)18/12/2012 13:40:02 - jasonw (
84.21.**.**
)> 421 Connection timed out.

(000036)18/12/2012 13:40:02 - jasonw (84.21.**.**)> disconnected.

I have checked all outgoing ports are set to allow all traffic with in the set range.

Any thoughts on what I am missing?

Edited by Intrinsica
: edited at OP's request
Link to comment
https://www.neowin.net/forum/topic/1126484-setting-up-ftps-with-filezilla/
Share on other sites

So your attempting a active connection there - your telling the client to connect to

PORT 84,21,xx,xx,192,13

I snipped out part of that IP, because of privacy concerns - I would suggest you edit that. Anyway you told the server to connect to that IP on port

192*256 + 13 = 49165, since your control channel is inside a encrypted connection (ssl/tls) the helper portion of most firewalls/routers can not open the return port for you.

Also from this

jasonw (84.21.xx.xx)> disconnected

where that is the same IP as your server? Are you attempting this from a loopback forward/nat reflection, ie are you on the same network as your server -- which I would assume is behind a nat? Maybe not? That can cause grief as well. And using the public ip of your router to try and connect where your router wold have to forward/reflect the traffic back into the servers private IP?

So questions for you - is your server behind a nat and really on a private IP? And this 84.21 is your public? Where is your client? is it outside your local network?

Great info when wanting to use ftp

http://slacksite.com/other/ftp.html

This goes over the difference between active and passive connections - which you need to know what your going to be using or allowing, etc. And you need to understand if your firewall/router has helper feature to change private to pubic, and allow the return data channel traffic in the firewall states, etc.

What firewall/router is your server/clients behind - if any?

After the day I am having I can fully believe I did that too (left IP in there), unfortunately I cant edit my previous post so will ask a mod to.

84.21.*.* is the client external IP, the server IP is 194.88.*.*

The server is behind Sonicwall NSA2400`s running in a High availability set up, apparently it is one range inside and one range out, they are 2 devices running in HA mode for resilience so one is effectively in standby. They share an IP inside and out and virtual MAC address, We are going to temporarily fully open the ports tomorrow and see if that 'solves' the issue. At least then we can see if it is firewall or setup. The client is behind a Cisco ASA server.

A little back ground to the project.

We are moving data centres and ISP from our old provider (the 84.21.*.*) to a new DC (a 194.88.*.*) - both are public IP's. Currently all of our web based traffic is exiting through the old provider while I transfer the hosted server services from old to new DC. New routers are due to arrive to connect the 2 new connections for our new ISP, one is web based traffic only with failover to the DC, other is MPLS dedicated connection to hosted servers.

Currently I am testing the access to the web/ftp server from outside the PWAN which is where I am getting this problem.

So,

The server is behind the Sonicwalls with a public IP of 194.88.*.*, private IP is 192.168.200.*. The client is on a separate PWAN using the public IP of 84.21.*.*, private IP is 192.168.11.*.

I am going to take a look at that article tonight and see what I am missing.

So on the client end your helper is not going to be able to see what port your client is listening on for the server to connect back to you because its inside a ssl/tls tunnel

This is the issue with ftps!!

So you could try a passive connection - but then your going to have issues with opening the ports on the server side because again the helper can not see what ports are going to be used.

Take a look at this article

http://wiki.filezill...k_Configuration

You should be able to setup the server side to use specific ports for the active connections - and then forward those on your firewall, etc. Another question for you are you going to be dong Implicit or Explicit. Since you called it ftps and not ftpes I would have think your using Implicit?

You know what is a MUCH EASIER solution -- use SFTP, there is only 1 port involved (22) because its over SSH. You can change that port if you want - but its still only 1 port!! No active/passive **** with split control and data channels. Much easier to work through nat and firewalls with ;)

Think I am gonna stick with FTPS (for now), prefer to fix this and learn a little and if I still cant get it going, will switch to SFTP.

So I have set FileZilla to use a specific port range and have requested the people who manage the server side NAT to fully open these ports to test the connection. Next I need to connect forcing passive mode so it is the client that establishes the data connection. So from that I now get this log from the client.

Status: Connection established, initializing TLS

Status: Verifying certificate

Status: TLS/SSL connection established, waiting for welcome message...

Response: 220-FileZilla Server version 0.9.41 beta

Response: 220 Welcome to The Swann Group download site.

Command: USER JasonW

Response: 331 Password required for jasonw[Command: PASS *********

Response: 230 Logged on

Command: PBSZ 0

Response: 200 PBSZ=0

Command: PROT P

Response: 200 Protection level set to P

Status: Connected

Status: Retrieving directory listing...

Command: PWD

Response: 257 "/" is current directory

Command: TYPE I

Response: 200 Type set to I

Command: PASV

Response: 227 Entering Passive Mode (217,161,**.**,58,153)

Command: MLSD

Error: GnuTLS error -53: Error in the push function

Response: 425 Can't open data connection

Error: Failed to retrieve directory listing

Response: 421 Connection timed out

Error: Connection closed by server

The IP address is completely wrong, not sure where that came from so I am looking into that but it is using the correct port.

Yeah that 217.161 is the IP the server is telling the client to connect too. It should be the same IP you connected too for the control channel connection.

that port would be 58x256 + 153 so 15001

Look in your server settings on where its getting IP from.. Could be going out a different connection your coming into it from? You can set that IP in the same place you set the ports to use for passive.

Well that makes no sense then. Other than if it thinks its local connection? You could try unchecking that and see what IP gets sent back. Clearly your hard coding the IP which is different than what your seeing.

Is it possible your connecting to a different ftp server? Did you try restarting the ftp server once you made that setting?

VICTORY!!

After a reboot and clearing the check box,

Response: 220-FileZilla Server version 0.9.41 beta

Response: 220 Welcome to The Swann Group download site.

Command: USER JasonW

Response: 331 Password required for jasonw

Command: PASS *********

Response: 230 Logged on

Command: PBSZ 0

Response: 200 PBSZ=0

Command: PROT P

Response: 200 Protection level set to P

Status: Connected

Status: Retrieving directory listing...

Command: PWD

Response: 257 "/" is current directory.

Status: Directory listing successful

Not sure if it was the reboot or clearing the check box but as all traffic to and from the FTP server will be from a public address then the box can stay cleared.

Thanks Budman, your help is very much appreciated!.

Glad you got it working, shouldn't have to worry about the checkbox if you don't have local users connecting, etc. But may need it if you do?? Prob put it back and connect from local machine, etc.

Although we are connected via an MPLS PWAN all ftp traffic is routed through a second connection so it should always be a public IP, but definitely worth noting though.

I even got to learn something new about active and passive connections which after the telephone conversation I just had with the managers and owners is quite a feat! Apparently a data centre migration is a simple task and should only take a couple of days.........

Understanding the difference between an active or passive ftp connection is 1st step in wanting to run a ftp server, or even connect to one when NAT is involved or firewalls even if everyone is on same network or fully public connections, etc.

These days most every client is going to be behind a nat - this will change as ipv6 takes hold. So you will run into issues all the time with either active or passive connections. Most firewalls and even home routers have helper features for ftp to allow the data side of the connection - but as you learned with ftps this all changes because the helper can not view the info to either change the IP sent to public vs private and or open the firewall for the connection by working out the ports given in the pasv or port command.

This thread should be a good reference for others looking to do the same thing as well.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Can you give an example of when you would want to use Rufus over the other or vice versa? Just wondering which is the "best".
    • Oh no...the wallet is already screaming. So many games and so little time. Being old and responsible is awful!
    • LibreWolf 152.0.2-1 by Razvan Serea LibreWolf is an independent “fork” of Firefox, with the primary goals of privacy security and user freedom. It is the community run successor to LibreFox. LibreWolf is designed to increase protection against tracking and fingerprinting techniques, while also including a few security improvements. This is achieved through our privacy and security oriented settings and patches. LibreWolf also aims to remove all the telemetry, data collection and annoyances, as well as disabling anti-freedom features like DRM. LibreWolf features: Latest Firefox — LibreWolf is compiled directly from the latest build of Firefox Stable. You will have the the latest features, and security updates. Independent Build — LibreWolf uses a build independent of Firefox and has its own settings, profile folder and installation path. As a result, it can be installed alongside Firefox or any other browser. No phoning home — Embedded server links and other calling home functions are removed. In other words, minimal background connections by default. User settings updates Extensions firewall: limit internet access for extensions. Multi-platform (Windows/Linux/Mac/and soon Android) Community-Driven Dark theme (classic and advanced) LibreWolf privacy features: Delete cookies and website data on close. Include only privacy respecting search engines like DuckDuckGo and Searx. Include uBlockOrigin with custom default filter lists, and Tracking Protection in strict mode, to block trackers and ads. Strip tracking elements from URLs, both natively and through uBO. Enable dFPI, also known as Total Cookie Protection. Enable RFP which is part of the Tor Uplift project. RFP is considered the best in class anti-fingerprinting solution, and its goal is to make users look the same and cover as many metrics as possible, in an effort to block fingerprinting techniques. Always display user language as en-US to websites, in order to protect the language used in the browser and in the OS. Disable WebGL, as it is a strong fingerprinting vector. Prevent access to the location services of the OS, and use Mozilla's location API instead of Google's API. Limit ICE candidates generation to a single interface when sharing video or audio during a videoconference. Force DNS and WebRTC inside the proxy, when one is being used. Trim cross-origin referrers, so that they don't include the full URI. Disable link prefetching and speculative connections. Disable disk cache and clear temporary files on close. Disable form autofill. Disable search and form history...and more. Download: LibreWolf 64-bit | Portable 64-bit | ~100.0 MB (Open Source) Download: ARM64 | Portable ARM64 Links: LibreWolf Home Page | Addons | Screenshot | Reddit Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Hands on with iFlyTek AINote 2 E-Ink tablet: insanely thin and smart by Taras Buria During Amazon Prime Day 2026, iFlyTek is offering its E-Ink tablets with big discounts. The AINOTE 2 is now available at 20% off, allowing you to save quite a lot on one of the thinnest E-Ink tablets out there. I was offered a chance to look at the device, so here are my impressions. The AINOTE 2 is a large 10.65-inch E-Ink tablet that strikes you the moment you take it out of the box. It is extremely thin. At just 4.2 mm, this tablet is at the edge of what is possible for a device with a USB Type-C port. It is also very light, which makes it comfortable and enjoyable during long reading sessions. The tablet has a gold metal chassis with the front and back made of plastic. The back also features four rubber feet that prevent it from sliding around your desk when writing. Besides a USB Type-C port and an LED indicator, there are two buttons mounted on the top edge: a power button with a built-in fingerprint scanner and a dedicated AI button. I would say the fingerprint scanner is quite mid. Given that iFlyTek positions the device as a digital notebook, it makes sense to have a biometric scanner to protect sensitive information. However, it is not the fastest fingerprint reader, and sometimes it fails to recognize my finger. I assume that is due to the tablet's insane thinness. A dedicated AI button is an interesting choice, especially in the middle of the top edge. I can see this button being useful for those who heavily rely on AI and use it frequently, but I cannot help but think its placement is impractical. Having it on one of the longer sides would make so much more sense. The AINOTE 2 is a very pretty device. Gold finish with thin chassis and nearly symmetrical front bezels create a fantastic combination, and iFlyTek cleverly hides the front chin with a section that looks like an extension of the screen, housing two touch-capacitive buttons: one for AI and one for quick notes. This section can also scroll pages when you swipe from the middle to the left or right. It is a cool idea, and very handy when you need to scroll tens of pages at once. AINOTE 2's elegant look extends from its exterior to its software. The user interface is very clean and not cluttered with an abundance of buttons. The tablet prioritizes the note-taking experience, and when you unlock it, it defaults to the list of all notes and folders. Additionally, there is a separate "Schedule" section with your calendar, tasks, memos, and other productivity features. You can connect your Outlook or Google account or use a local calendar. The tablet has quite a lot of AI features powered by OpenAI's GPT-5 and Google's Gemini 3. Besides a standard app with all your chats, you can invoke AI by pressing its dedicated button and dictating your request. It is not limited to just chats. It works with the built-in calendar, and you can tell it to create events, tasks, notes, and more. Additionally, AI features are integrated into the built-in notepad, allowing you to summarize notes, ask questions about your notes, and more. The tablet can OCR handwritten text in different languages (about 120 languages, which is very impressive), and it surprised me with very good accuracy. Voice note transcription is also available, including a "multiplayer" mode where the tablet detects each speaker. Unfortunately, the AINOTE 2 has no built-in speakers (even though it somehow makes a tapping noise when you flip pages using the Quick Bar), so the only way to listen to something is to connect a Bluetooth speaker or headphones. However, there are four front-facing mics for dictation, voice notes, AI chats, and more. Unfortunately, certain features require a Pro subscription that costs $5.99/mo or $59.99/year. Those include offline voice transcription, access to better AI models, the ability to edit notes on a PC or mobile app, and extended service coverage similar to Apple Care. It is a bummer to see yet another app, especially in a device that costs $649, but at least they give a free 90-day trial so that you can see if the benefits justify the price. As for the reader, it supports PDF, EPUB, TXT, MOBI, AZW3, DOC(X), XLS(X), PPT(X), JPEG, JPG, and PNG. The app is quite customizable, with features like text contrast/boldness/size adjustments, margins and spacing customization, and the ability to load custom fonts. Plus, you can annotate books with the stylus, add text notes, and use AI to work with them. Just keep in mind that most AI features require an active internet connection. Like with other E-Ink tablets with Android inside, you can load any other reader you want from the Google Play Store or a third-party source. Despite its hefty price tag of $629 or $519 by the time of publishing this article during Prime Day 2026, the AINOTE 2 has quite modest hardware inside. There is only 4 GB of RAM and about 42GB of storage. It is powered by the RockChip RK3576 processor with 8 cores at 2.2 GHz. Given that the tablet runs Android 14 and has Google Play, you can install Android apps, but do not expect much from this thing performance-wise. As for the battery, there is a 4,000 Li-Ion battery, which, on full charge, lasted me for about one week of active daily use of reading and note-taking. The screen has a resolution of 1920x2560 pixels, which equals 300 PPI, a perfect spot for a sharp, nice-to-read display. It supports EMR styluses that do not require charging, and I have to say that the note-taking experience on this tablet is fantastic. Stylus lag is nearly imperceivable, creating a very natural, paper-like feel. The stylus comes in the box (including two extra nibs), and it features an extra button for various actions and an eraser on top. It magnetically attaches to the tablet and stays safely secured. The stylus has a very nice coarse texture, and thanks to using Wacom tech, you can swap it for any other EMR pen if you wish. The AINOTE 2 has no front light, and because of that, the display sits very close to the screen surface, reducing the distance between the stylus tip/your finger and the display to a minimum. No front light is certainly an inconvenience in certain scenarios, but the screen makes up for that with a seriously impressive paper-like feel and writing experience. In dark conditions, you will have to find a lamp, but the good thing is that the screen has a solid anti-glare surface that diffuses light. The display has two modes: Crisp and Fast. Crisp ensures the image stays, well, crisp and sharp, while Fast speeds up refresh rate and response by toning down display resolution and making everything a bit more jagged. In my testing, I only used Fast mode when browsing the web for a much faster render time. The iFlyTek AINOTE is an impressive device, but it's not flawless. A few things disappointed me during a week of using it. Software localization has a bunch of not necessarily broken, but certainly awkward, machine-translated English. System navigation is not good, as there is no universal "Home" gesture. To go to the main page, you have to swipe up and then press the Home button from the multi-tasking window. There are many gestures for various actions, such as display cleanup, screenshot, undo/redo, but no back/forward or Home gestures. I really hate that the tablet won't let me update its software without creating an iFlyTek account first. Finally, privacy could be a concern for some, as most tablets' features require an active internet connection, an iFlyTek account, and sharing data when using AI. If you can overlook its quirks, some of which could be addressed with software updates (I received two with massive changelogs over a single week), and accept a $519 price tag (with a discount), you will be happy with the AINOTE 2. However, if you do not need that many AI features in an E-Ink reader or you want something a bit more affordable, you'd better look at cheaper competitors from BOOX or Amazon, such as the BOOX Go 10.3 Gen 2 or the Kindle Scribe, which is currently 24% off during Prime Day sales. Buy iFlyTek AINOTE 2 on Amazon - $519 | 20% off with Prime What I liked What I disliked Very impressive hardware Beautiful design Fantastic display with an EMR stylus Supports offline voice transcription Easy-to-use software Clever, useful, and well-made AI features A fingerprint scanner Very expensive Some features require a subscription Poor system navigation Mandates a user account No speakers Privacy could be a concern Note: iFlyTek provided the review unit without any editorial input or review guidance. As an Amazon Associate, we earn from qualifying purchases.
    • Look up "greed". If you are willing to buy that it's only inflation, I've got a bridge to sell you.
  • Recent Achievements

    • First Post
      kinowa earned a badge
      First Post
    • Rookie
      krychek57 went up a rank
      Rookie
    • Grand Master
      Jaybonaut went up a rank
      Grand Master
    • One Year In
      Philsl earned a badge
      One Year In
    • Dedicated
      Scoobystu earned a badge
      Dedicated
  • Popular Contributors

    1. 1
      +primortal
      416
    2. 2
      +Edouard
      168
    3. 3
      PsYcHoKiLLa
      132
    4. 4
      Xenon
      73
    5. 5
      Michael Scrip
      73
  • Tell a friend

    Love Neowin? Tell a friend!