SFTP connections blocked by a Fritzbox router typically stem from misconfigured port forwarding rules, strict firewall policies, or IPv6 routing conflicts. When Wireshark shows outgoing packets with no response, the issue is usually that the return traffic is dropped by the router’s NAT table because the internal server IP has changed or the port mapping is invalid. This guide details how to verify your local network configuration and update your Fritzbox settings to restore secure file transfer access.
Verifying Local Network Connectivity
Before modifying router settings, you must confirm that the SFTP service is actually running and reachable within your local area network. A common cause of "no response" symptoms is that the target machine’s IP address has changed via DHCP, breaking the static port forward rule previously established in the Fritzbox. You should first check the IP address assigned to the computer hosting the SFTP server by opening a terminal or command prompt and using
ipconfig on Windows or
ifconfig or
ip addr on Linux and macOS. Ensure this IP matches the one configured in your router’s port forwarding section. If the IP has changed, you can either update the manual entry or reserve a static IP for that device through the Fritzbox’s LAN settings to prevent future drift. Additionally, verify that the SFTP daemon (such as OpenSSH) is active and listening on the default port 22 or your custom port by checking the service status. On Linux, you might use
systemctl status sshd, while on Windows, you can check the Services panel for the OpenSSH Server. If the service is not running, start it and ensure it is set to automatic startup.
Configuring Port Forwarding in Fritzbox
The core of the troubleshooting process involves ensuring that incoming SFTP traffic is correctly routed to your internal server. Log into your Fritzbox administration interface, which is typically accessible at
http://fritz.box. Navigate to the
Internet menu and select
Port Sharing. Here, you will see a list of existing port forwarding rules. Look for an entry corresponding to your SFTP port. If it does not exist, you need to create a new one. Click
Add New Port Sharing Rule and enter a descriptive name such as "SFTP Server". Set the protocol to
TCP, as SFTP relies on TCP connections for reliable data transmission. Enter the external port (usually 22, though you may use a non-standard port for security) and the internal port (the port your SSH daemon is listening on). Crucially, select the specific internal computer from the dropdown menu rather than leaving it blank or selecting "Other". Save the rule. If you already have a rule but it is failing, delete it and recreate it to clear any corrupted state. It is also worth noting that if you are trying to expose a local server on a VPS or other remote infrastructure, you might find
Expose Local Server on VPS Preserving Real Client IPs (OS Level) relevant for understanding broader networking concepts, although direct home router configuration remains distinct.
Checking Firewall and Security Settings
Even with correct port forwarding, the connection can be blocked by host-level firewalls on the target machine or the router’s built-in security features. On the server computer, ensure that the firewall allows inbound connections on the SFTP port. In Windows Defender Firewall, add an inbound rule for TCP port 22. On Linux, check
ufw or
iptables rules to ensure they are not dropping the traffic. Within the Fritzbox interface, navigate to
Internet >
Filters >
User-defined Filters. Verify that there are no active filters blocking incoming traffic on the SFTP port. Some users inadvertently enable parental controls or guest network restrictions that block specific ports. If you are using a Guest Network, remember that devices on guest networks are often isolated from the main LAN and cannot initiate connections to internal servers unless explicitly allowed. Also, consider disabling the
Anti-Spam or
Firewall features temporarily during testing to isolate whether they are causing the drop. However, do not leave these disabled permanently. If you suspect an IPv6 issue, try connecting using the IPv4 address explicitly, as some older clients or misconfigured routers handle dual-stack scenarios poorly. You can disable IPv6 in the Fritzbox under
Internet >
Access Settings if necessary, forcing all traffic through IPv4 where compatibility is generally higher.
Testing and Troubleshooting Persistent Issues
After applying the changes, test the connection from an external network. Do not test from within the same Wi-Fi network if possible, as some routers do not support NAT loopback properly. Use a mobile data connection or ask a friend to attempt the connection. Check your Fritzbox logs under
System >
Fritz!Box Log to see if incoming attempts are being logged and dropped. If you see denied entries, note the source IP and port to refine your rules. If the connection still fails, use Wireshark on the client side again to see if SYN-ACK packets are returning. If they are not, the packet is likely being dropped by the ISP or the router’s WAN interface. Contact your ISP to ensure they are not blocking port 22, as some providers restrict common service ports for residential plans. Alternatively, change the external port to a high-numbered port (e.g., 2222) and map it to internal port 22. This bypasses many basic ISP blocks. Remember that changing ports requires updating your client configuration to specify the new port number. For more complex network setups involving web filtering or subdomain routing, you might explore
Free Web Filtering Software at Subdomain Level to understand how different layers of network filtering interact, though this is less directly applicable to raw SFTP port issues.
Frequently Asked Questions
Why does my SFTP work locally but not remotely?
This indicates that the SFTP service is running correctly on the server, but the router is not forwarding external traffic to it. Ensure your port forwarding rule points to the correct internal IP address and that the rule is enabled in the Fritzbox Port Sharing menu.
Can I use a different port for SFTP to avoid blocking?
Yes, you can map an external port like 2222 to the internal port 22. This helps bypass ISP blocks on standard ports and adds obscurity-based security. Update your SFTP client to connect to the new external port number.
What if the Fritzbox log shows no incoming attempts?
If the log is empty, the packets are likely being dropped before reaching the Fritzbox, possibly by your ISP or due to DNS resolution failures. Verify that your domain name or public IP resolves correctly and check with your ISP regarding port availability.
Does enabling UPnP help with SFTP connections?
UPnP can automate port forwarding but is often discouraged for security reasons as it allows applications to open ports without user consent. Manually configuring port sharing in the Fritzbox is more secure and reliable for SFTP access.
How do I reset port forwarding settings in Fritzbox?
You can delete individual rules in the Port Sharing menu or reset the entire router to factory defaults via the System backup page. Resetting is a last resort; prefer deleting specific rules to maintain other configurations.