The Windows Firewall blocks IIS FTP connections when inbound rules for the FTP service are missing, disabled, or misconfigured. To resolve this, you must enable the built-in firewall rule for FTP Traffic In (TCP) in Windows Defender Firewall with Advanced Security. This action allows standard control connections on port 21 and data connections depending on whether active or passive mode is used.
Understanding FTP Connection Modes
Before adjusting firewall settings, it is crucial to understand how FTP handles network traffic because the firewall requirements differ significantly between Active and Passive modes. FTP uses two separate channels: a control channel for commands and a data channel for file transfers. The control channel always connects from the client to the server on port 21. The data channel behavior changes based on the mode selected in your IIS configuration.
In Active Mode, the server initiates the data connection back to the client. The client sends a PORT command indicating its IP address and a high-numbered ephemeral port. The server then attempts to connect from port 20 to that specific client port. While this seems straightforward, many modern clients sit behind NAT routers that drop these incoming connections from the internet, making Active Mode unreliable for external users.
In Passive Mode (PASV), the client initiates both connections. After establishing the control connection, the client sends a PASV command. The server responds with an IP address and a range of high-numbered ports available for data transfer. The client then connects to one of those ports. This requires the firewall to allow inbound traffic to a wide range of dynamic ports, which is often where configuration errors occur. If you have previously configured passive ports in IIS, you must ensure the firewall permits traffic to that specific range.
Enabling the Default FTP Firewall Rule
Windows Server includes a predefined firewall rule specifically designed to handle FTP traffic. By default, this rule may be disabled or not applied to the correct network profile (Private, Public, or Domain). You need to verify and enable this rule manually through the graphical interface or PowerShell.
Open the
Administrative Tools menu and launch
Windows Defender Firewall with Advanced Security. Navigate to the
Inbound Rules section in the left pane. Scroll down the list and locate the rule named
FTP Traffic In (TCP-In). You can identify it by checking the description or the program path, which typically points to
%SystemRoot%\system32\ftpsvc.dll.
Right-click the rule and select
Properties. Ensure that the rule is set to
Enabled. Check the
Scope tab to verify that it applies to the IP addresses relevant to your setup. For most internal servers, leaving it as
Any is acceptable, but if you have strict security policies, you may restrict it to specific subnets. Finally, check the
Action tab to confirm it is set to
Allow the connection.
If you prefer using PowerShell, you can enable the rule with a single command. Run the following command in an elevated PowerShell session:
Enable-NetFirewallRule -DisplayName "FTP Traffic In (TCP-In)"
This command automatically enables the rule across all network profiles. If the rule does not exist, it indicates that the FTP Service feature was not installed correctly or the firewall components were not registered properly during installation.
Configuring Passive Port Ranges
When using Passive Mode, the firewall rule for FTP Traffic In alone is insufficient because it only covers the control port. You must also create additional inbound rules to allow the dynamic data ports. IIS allows you to configure a specific range of ports for passive connections to limit the exposure surface area.
First, open
IIS Manager and select the server node in the left connection pane. Double-click
FTP Firewall Support under the
FTP section in the middle pane. In the
Passive Port Range field, enter a small, manageable range such as
50000-50100. Avoid large ranges like thousands of ports, as they increase attack vectors and complicate firewall management. Note the
External IP Address field; if your server is behind a NAT gateway, this must match the public IP address assigned to your router, not the local private IP.
Once you have defined the port range, return to
Windows Defender Firewall with Advanced Security. Create a new inbound rule by selecting
New Rule under
Inbound Rules. Choose
Port as the rule type and select
TCP. Enter the specific port range you configured in IIS (e.g.,
50000-50100). Proceed through the wizard, setting the action to
Allow the connection and applying it to all profiles. Name the rule clearly, such as
IIS FTP Passive Data Ports.
This step ensures that the firewall explicitly permits the data connections initiated by clients in passive mode. Without this rule, clients will hang indefinitely when trying to list directories or upload files, even though the initial login succeeds.
Verifying Connectivity and Troubleshooting
After enabling the firewall rules and configuring passive ports, test the connection using an FTP client. Use a tool like
FileZilla or the command-line
ftp utility. Attempt to connect to the server on port 21. If the connection drops after authentication, the issue is likely related to the data channel.
Check the Windows Event Viewer for any firewall-related warnings. Navigate to
Applications and Services Logs >
Microsoft >
Windows >
Firewall >
Diagnostics. Look for events indicating blocked packets on the passive port range. If you see blocked events, re-verify that the inbound rule matches the exact port range defined in IIS.
Additionally, ensure that the
FTP Publishing Service is running. Open
Services.msc and verify that
FTP Publishing Service is set to
Automatic startup and is currently
Running. If the service is stopped, no firewall rules will effectively manage traffic because the application handling the protocol is inactive.
For further assistance with IIS connectivity issues, refer to our guide on
Configuring IIS FTP Server on Windows to Allow Remote User File Downloads with Another Local Program, which details advanced user permission setups. If you encounter broader network reachability problems unrelated to FTP ports, check
Unblocking Port 80443 for IIS Web Server for general troubleshooting patterns.
Frequently Asked Questions
Why does my FTP login succeed but directory listing fail?
This symptom almost always indicates a firewall block on the data channel rather than the control channel. In passive mode, the client connects to a dynamic port for listing files, so you must ensure your firewall allows inbound traffic to the passive port range configured in IIS.
Can I use Active Mode instead of Passive Mode?
Yes, but Active Mode is generally discouraged for internet-facing servers because it requires the server to initiate connections back to the client. Most modern firewalls and NAT devices block these incoming connections from the server, causing timeouts unless you have full visibility into the client's network configuration.
What happens if I leave the Passive Port Range empty?
If you leave the range empty in IIS, the system defaults to a very large range of ephemeral ports (typically 49152-65535). Configuring a smaller, explicit range is recommended to simplify firewall rules and reduce the number of open ports exposed to potential attackers.
How do I reset the FTP Firewall rule if I accidentally deleted it?
You can restore the default rule by reinstalling the FTP Server feature via Server Manager. Alternatively, export the default firewall configuration from a clean server or recreate the rule manually with the same display name and parameters as the original system-generated rule.
Does enabling the FTP rule affect HTTPS or HTTP traffic?
No, the FTP firewall rule is specific to TCP port 21 and the designated passive data ports. It does not interfere with web traffic on ports 80 or 443, which are managed by separate firewall rules for IIS Web Server.