Recommended Posts

Hi.

I am setting up an FTPS server using FileZilla on a Server 2008 R2 VM but I am struggling to get the directory listings up.

I have created the certificate and key password and it imports without any problem into FileZilla (client) but I get the log below

Status: Connection established, initializing TLS...

Status: Verifying certificate...

Status: TLS/SSL connection established, waiting for welcome message...

Response: 220-FileZilla Server version 0.9.41 beta

Response: 220 Welcome to The Swann Group download site.

Command: USER JasonW

Response: 331 Password required for jasonw

Command: PASS *********

Response: 230 Logged on

Command: PBSZ 0

Response: 200 PBSZ=0

Command: PROT P

Response: 200 Protection level set to P

Status: Connected

Status: Retrieving directory listing...

Command: PWD

Response: 257 "/" is current directory.

Command: TYPE I

Response: 200 Type set to I

Command: PORT 84,21,143,150,192,13

Response: 200 Port command successful

Command: MLSD

Response: 150 Opening data channel for directory list.

Response: 425 Can't open data connection.

Error: Failed to retrieve directory listing

Response: 421 Connection timed out.

Error: Connection closed by server

And from the server I get,

(000036)18/12/2012 13:36:49 - (not logged in) (
84.21.**.**
)> Connected, sending welcome message...

(000036)18/12/2012 13:36:49 - (not logged in) (
84.21.**.**
)> SSL connection established

(000036)18/12/2012 13:36:49 - (not logged in) (
84.21.**.**
)> USER JasonW

(000036)18/12/2012 13:36:49 - (not logged in) (
84.21.**.**
)> 331 Password required for jasonw

(000036)18/12/2012 13:36:49 - (not logged in) (
84.21.**.**
)> PASS *********

(000036)18/12/2012 13:36:49 - jasonw (
84.21.**.**
)> 230 Logged on

(000036)18/12/2012 13:36:49 - jasonw (
84.21.**.**
)> PBSZ 0

(000036)18/12/2012 13:36:49 - jasonw (
84.21.**.**
)> 200 PBSZ=0

(000036)18/12/2012 13:36:50 - jasonw (
84.21.**.**
)> PROT P

(000036)18/12/2012 13:36:50 - jasonw (
84.21.**.**
)> 200 Protection level set to P

(000036)18/12/2012 13:36:50 - jasonw (
84.21.**.**
)> PWD

(000036)18/12/2012 13:36:50 - jasonw (
84.21.**.**
)> 257 "/" is current directory.

(000036)18/12/2012 13:36:51 - jasonw (
84.21.**.**
)> TYPE I

(000036)18/12/2012 13:36:51 - jasonw (
84.21.**.**
)> 200 Type set to I

(000036)18/12/2012 13:36:51 - jasonw (
84.21.**.**
)> PORT 84,21,143,150,192,13

(000036)18/12/2012 13:36:51 - jasonw (
84.21.**.**
)> 200 Port command successful

(000036)18/12/2012 13:36:51 - jasonw (
84.21.**.**
)> MLSD

(000036)18/12/2012 13:36:51 - jasonw (
84.21.**.**
)> 150 Opening data channel for directory list.

(000036)18/12/2012 13:37:01 - jasonw (
84.21.**.**
)> 425 Can't open data connection.

(000036)18/12/2012 13:40:02 - jasonw (
84.21.**.**
)> 421 Connection timed out.

(000036)18/12/2012 13:40:02 - jasonw (84.21.**.**)> disconnected.

I have checked all outgoing ports are set to allow all traffic with in the set range.

Any thoughts on what I am missing?

Edited by Intrinsica
: edited at OP's request
Link to comment
https://www.neowin.net/forum/topic/1126484-setting-up-ftps-with-filezilla/
Share on other sites

So your attempting a active connection there - your telling the client to connect to

PORT 84,21,xx,xx,192,13

I snipped out part of that IP, because of privacy concerns - I would suggest you edit that. Anyway you told the server to connect to that IP on port

192*256 + 13 = 49165, since your control channel is inside a encrypted connection (ssl/tls) the helper portion of most firewalls/routers can not open the return port for you.

Also from this

jasonw (84.21.xx.xx)> disconnected

where that is the same IP as your server? Are you attempting this from a loopback forward/nat reflection, ie are you on the same network as your server -- which I would assume is behind a nat? Maybe not? That can cause grief as well. And using the public ip of your router to try and connect where your router wold have to forward/reflect the traffic back into the servers private IP?

So questions for you - is your server behind a nat and really on a private IP? And this 84.21 is your public? Where is your client? is it outside your local network?

Great info when wanting to use ftp

http://slacksite.com/other/ftp.html

This goes over the difference between active and passive connections - which you need to know what your going to be using or allowing, etc. And you need to understand if your firewall/router has helper feature to change private to pubic, and allow the return data channel traffic in the firewall states, etc.

What firewall/router is your server/clients behind - if any?

After the day I am having I can fully believe I did that too (left IP in there), unfortunately I cant edit my previous post so will ask a mod to.

84.21.*.* is the client external IP, the server IP is 194.88.*.*

The server is behind Sonicwall NSA2400`s running in a High availability set up, apparently it is one range inside and one range out, they are 2 devices running in HA mode for resilience so one is effectively in standby. They share an IP inside and out and virtual MAC address, We are going to temporarily fully open the ports tomorrow and see if that 'solves' the issue. At least then we can see if it is firewall or setup. The client is behind a Cisco ASA server.

A little back ground to the project.

We are moving data centres and ISP from our old provider (the 84.21.*.*) to a new DC (a 194.88.*.*) - both are public IP's. Currently all of our web based traffic is exiting through the old provider while I transfer the hosted server services from old to new DC. New routers are due to arrive to connect the 2 new connections for our new ISP, one is web based traffic only with failover to the DC, other is MPLS dedicated connection to hosted servers.

Currently I am testing the access to the web/ftp server from outside the PWAN which is where I am getting this problem.

So,

The server is behind the Sonicwalls with a public IP of 194.88.*.*, private IP is 192.168.200.*. The client is on a separate PWAN using the public IP of 84.21.*.*, private IP is 192.168.11.*.

I am going to take a look at that article tonight and see what I am missing.

So on the client end your helper is not going to be able to see what port your client is listening on for the server to connect back to you because its inside a ssl/tls tunnel

This is the issue with ftps!!

So you could try a passive connection - but then your going to have issues with opening the ports on the server side because again the helper can not see what ports are going to be used.

Take a look at this article

http://wiki.filezill...k_Configuration

You should be able to setup the server side to use specific ports for the active connections - and then forward those on your firewall, etc. Another question for you are you going to be dong Implicit or Explicit. Since you called it ftps and not ftpes I would have think your using Implicit?

You know what is a MUCH EASIER solution -- use SFTP, there is only 1 port involved (22) because its over SSH. You can change that port if you want - but its still only 1 port!! No active/passive **** with split control and data channels. Much easier to work through nat and firewalls with ;)

Think I am gonna stick with FTPS (for now), prefer to fix this and learn a little and if I still cant get it going, will switch to SFTP.

So I have set FileZilla to use a specific port range and have requested the people who manage the server side NAT to fully open these ports to test the connection. Next I need to connect forcing passive mode so it is the client that establishes the data connection. So from that I now get this log from the client.

Status: Connection established, initializing TLS

Status: Verifying certificate

Status: TLS/SSL connection established, waiting for welcome message...

Response: 220-FileZilla Server version 0.9.41 beta

Response: 220 Welcome to The Swann Group download site.

Command: USER JasonW

Response: 331 Password required for jasonw[Command: PASS *********

Response: 230 Logged on

Command: PBSZ 0

Response: 200 PBSZ=0

Command: PROT P

Response: 200 Protection level set to P

Status: Connected

Status: Retrieving directory listing...

Command: PWD

Response: 257 "/" is current directory

Command: TYPE I

Response: 200 Type set to I

Command: PASV

Response: 227 Entering Passive Mode (217,161,**.**,58,153)

Command: MLSD

Error: GnuTLS error -53: Error in the push function

Response: 425 Can't open data connection

Error: Failed to retrieve directory listing

Response: 421 Connection timed out

Error: Connection closed by server

The IP address is completely wrong, not sure where that came from so I am looking into that but it is using the correct port.

Yeah that 217.161 is the IP the server is telling the client to connect too. It should be the same IP you connected too for the control channel connection.

that port would be 58x256 + 153 so 15001

Look in your server settings on where its getting IP from.. Could be going out a different connection your coming into it from? You can set that IP in the same place you set the ports to use for passive.

Well that makes no sense then. Other than if it thinks its local connection? You could try unchecking that and see what IP gets sent back. Clearly your hard coding the IP which is different than what your seeing.

Is it possible your connecting to a different ftp server? Did you try restarting the ftp server once you made that setting?

VICTORY!!

After a reboot and clearing the check box,

Response: 220-FileZilla Server version 0.9.41 beta

Response: 220 Welcome to The Swann Group download site.

Command: USER JasonW

Response: 331 Password required for jasonw

Command: PASS *********

Response: 230 Logged on

Command: PBSZ 0

Response: 200 PBSZ=0

Command: PROT P

Response: 200 Protection level set to P

Status: Connected

Status: Retrieving directory listing...

Command: PWD

Response: 257 "/" is current directory.

Status: Directory listing successful

Not sure if it was the reboot or clearing the check box but as all traffic to and from the FTP server will be from a public address then the box can stay cleared.

Thanks Budman, your help is very much appreciated!.

Glad you got it working, shouldn't have to worry about the checkbox if you don't have local users connecting, etc. But may need it if you do?? Prob put it back and connect from local machine, etc.

Although we are connected via an MPLS PWAN all ftp traffic is routed through a second connection so it should always be a public IP, but definitely worth noting though.

I even got to learn something new about active and passive connections which after the telephone conversation I just had with the managers and owners is quite a feat! Apparently a data centre migration is a simple task and should only take a couple of days.........

Understanding the difference between an active or passive ftp connection is 1st step in wanting to run a ftp server, or even connect to one when NAT is involved or firewalls even if everyone is on same network or fully public connections, etc.

These days most every client is going to be behind a nat - this will change as ipv6 takes hold. So you will run into issues all the time with either active or passive connections. Most firewalls and even home routers have helper features for ftp to allow the data side of the connection - but as you learned with ftps this all changes because the helper can not view the info to either change the IP sent to public vs private and or open the firewall for the connection by working out the ports given in the pasv or port command.

This thread should be a good reference for others looking to do the same thing as well.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • BrowserOS 0.46.0 by Razvan Serea BrowserOS is a free, open-source Chromium-based browser that runs AI agents natively, offering a smarter, more productive browsing experience. It supports Chrome extensions and integrates AI agents to automate tasks, fill forms, and streamline workflows. Your data stays on your computer: you can use your own API keys or run local models via Ollama, making it a privacy-first alternative to tools like Perplexity, Comet, or Dia. With built-in productivity tools and app integrations, BrowserOS boosts efficiency while keeping control firmly in your hands. Being Chromium-based, BrowserOS lets you effortlessly import your bookmarks, passwords, and Chrome extensions in just a few clicks. BrowserOS works with OpenAI GPT models, Anthropic Claude, Google Gemini, and local AI models via Ollama or LMStudio. You can use your own API keys and effortlessly switch between providers. BrowserOS Agent Your AI productivity assistant that organizes and manages your browsing effortlessly Quickly list, group, or close tabs Save and resume browsing sessions Search your history and organize bookmarks Switch instantly to the tab you need BrowserOS Navigator – Automate web tasks with ease Navigate websites and search automatically Interact with pages without manual effort Handle repetitive tasks in seconds What makes BrowserOS special Feels like home - same familiar interface as Google Chrome, works with all your extensions AI agents that run on YOUR browser, not in the cloud Privacy first - bring your own keys or use local models with Ollama. Your browsing history stays on your computer Open source and community driven - see exactly what's happening under the hood MCP store to one-click install popular MCPs and use them directly in the browser bar (coming soon) Built-in AI ad blocker that works across more scenarios! BrowserOS 0.46.0 changelog: Run Claude Code & Codex right in your browser — We've extended the agent harness to bring full coding agents into BrowserOS. Claude Code and Codex now come bundled and plug straight into the assistant, so you can drive your browser with the agent — and the subscription — you already use. A brand new experience — A redesigned new tab, a calmer composer, and a rebuilt command center for switching between agents. The whole assistant is cleaner, faster to reach, and easier to live in. New MCP tools — We rebuilt the browser tool surface from the ground up — a tighter, more reliable set of tools for agents to drive the browser. Plus one-click install of BrowserOS as an MCP server into the agents you already run, with automatic URL sync. Chromium 148 — Updated to the latest Chromium base with all recent upstream fixes and security patches. Streamlined — We've pulled back a few features that weren't getting much use — Skills, Soul, and Memory — so we can focus and ship better versions of them soon. Download: BrowserOS 0.46.0 | 181.0 MB (Open Source) Download: BrowserOS for macOS | 485.0 MB Links: BrowserOS Homepage | Github | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Microsoft finally admits its default Windows 11 25H2, 24H2 action broke key legacy component by Sayan Sen Microsoft last week released Windows 11 KB5094126 and KB5093998 as the latest Patch Tuesday updates. Following that the company also published the accompanying dynamic updates under KB5094149, KB5095971, and KB5094156. So far the company has acknowledged two known issues that have popped up after the release which include bugged-out Office apps as well as the Recycle Bin; though there could be more at play too. Speaking of bugs and issues, Microsoft seems to have finally acknowledged a problem that probably has been around for close to a year. That's because back in July of 2025 the company made a default change to the latest Windows 11 versions, wherein it switched to JScript9Legacy on Windows 11 24H2 and later releases. Hence following the release of version 25H2 in October 2025, JScript9Legacy also remained default-enabled. As a result there has been a compatibility issue ever since then. For those wondering, by switching to JScript9Legacy Microsoft intended to improve the security of modern Windows PCs by reducing vulnerabilities tied to legacy scripting like cross-site scripting (XSS), among others. XSS exploits can allow cyber-attackers to attach malicious code onto legitimate websites and use them to execute the code when a potential victim loads such a website. Hence the new JScript9Legacy engine enforced stricter execution policies and improved object handling, which should help mitigate such attacks. Microsoft today has published a new support article detailing the problem. Neowin spotted it while browsing. The company says that JScript global definitions and execution context may fail to persist across scripts, potentially breaking older dependent apps and web-based components that relied on this legacy behavior. In the article Microsoft has confirmed that the issue stems from its move away from the older jscript9.dll engine in favor of jscript9legacy.dll. As mentioned above, while the newer engine was designed to address vulnerabilities and strengthen security it also changes how JScript handles execution context. As a result functions and definitions loaded by one script could no longer remain available to subsequent scripts once execution ended. The company notes that some applications worked correctly on earlier Windows versions because the older JScript engine automatically retained global definitions and execution state between scripts. Under the newer model though that behavior is disabled by default causing certain legacy workloads and polyfill-dependent scripts to fail. Microsoft says it addressed the problem via the KB5077241 update though the fix had not been enabled automatically in the following updates. As such admins must explicitly turn on persistent JScript execution context using a Registry setting that the tech giant shared today. The configuration can be applied to individual processes or system-wide through the FEATURE_ENABLE_PERSISTENCE registry key. The steps have been outlined below: Run the following command to create the feature control registry key: reg add "HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_PERSISTENCE" Under this key, create a new DWORD (32-bit) value. Configure the value as follows: To enable persistence for specific processes only: Set the value to 1 for each target process name. To enable persistence for all processes: Add * as the key name and set its value to 1. You can find the official support article here on Microsoft's website.
    • The possibility that milk gathers back into a glass implies that gravity can be 'reversed'.
    • VidCoder 12.20 by Razvan Serea  VidCoder is a DVD/Blu-ray ripping and video transcoding application for Windows. It uses HandBrake as its encoding engine. Calling directly into the HandBrake library gives it a more rich UI than the official HandBrake Windows GUI. VidCoder can rip DVDs but does not defeat the CSS encryption found in most commercial DVDs. You’ll need the NET 8 Desktop Runtime. If you don’t have it, VidCoder will prompt you to download and install it. The Portable version is self-contained and does not require any .NET Runtime to be installed. You do not need to install HandBrake for VidCoder to work. Feature list: Multi-threaded MP4, MKV containers Completely integrated encoding pipeline: everything is in one process and no huge intermediate temporary files H.264, H.265, MPEG-4, MPEG-2, VP8, Theora video Hardware-accelerated encoding with AMD VCE, Nvidia NVENC and Intel QuickSync AAC, MP3, Vorbis, AC3, FLAC audio encoding and AAC/AC3/MP3/DTS/DTS-HD passthrough Target bitrate, size or quality for video 2-pass encoding Decomb, detelecine, deinterlace, rotate, reflect, chroma smooth, colorspace filters Powerful batch encoding with simultaneous encodes Customizable Pickers to automatically pick audio and subtitle tracks, destination, titles and more Instant source previews Creates small encoded preview clips Pause, resume encoding VidCoder 12.20 changes: Updated HandBrake core to 1.11.2. Download: VidCoder 12.20 | 47.0 MB (Open Source) Download: Portable VidCoder 12.19 | 89.3 MB Link: VidCoder Home Page | Github | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
  • Recent Achievements

    • Week One Done
      Jordan Smith earned a badge
      Week One Done
    • Reacting Well
      BizSAR earned a badge
      Reacting Well
    • First Post
      AndreaB earned a badge
      First Post
    • Week One Done
      Huge Trailer earned a badge
      Week One Done
    • Week One Done
      Classifyskilleducation earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      590
    2. 2
      +Edouard
      185
    3. 3
      PsYcHoKiLLa
      76
    4. 4
      Michael Scrip
      73
    5. 5
      Steven P.
      66
  • Tell a friend

    Love Neowin? Tell a friend!