Enabling Passive FTP in IIS 7 allows the client to initiate both the control and data channels.

Bobcares answers all questions, big and small, as part of our Server Management service.

Let’s examine in more detail how our Support team configured Passive FTP in IIS 7.

Enabling Passive FTP in IIS 7

The passive mode of FTP was developed to relieve some of the client-side burdens of firewall configuration. So, in contrast to active FTP, passive FTP starts both the control and data channels at the client’s request.

Setting up the Classic FTP Service to use Passive FTP Ports

Firstly, launch the command prompt and enter the following command:


cd "C:\inetpub\AdminScripts"

cscript adsutil.vbs set /MSFTPSVC/PassivePortRange "55000-60000"

The first command replaces the script engine from wscript to cscript. Generally, it defines the passive FTP Port in C:\Windows\System32\inetsrv\MetaBase.xml.

Windows Firewall configuration for Classic FTP Service to enable passive FTP ports

Use the following commands from a command prompt while logged in as the administrator.


netsh advfirewall firewall add rule name="FTP Service" action=allow service=msftpsvc protocol=TCP dir=in

netsh advfirewall set global StatefulFTP disable

Setting up the FTP 7.5 Module(FTPSVC) to use Passive FTP Ports

IIS is setup to do this as will be described below.

1. Firstly, launch IIS.
2. Then access the main server’s FTP Firewall Support.
3. Then Define the port range as 55000-60000.
4. Finally, click apply.

Setting up Windows Firewall in the FTP 7.5 Module to allow passive FTP ports

Generally, we use the following commands from a command prompt while logged in as the administrator.


netsh advfirewall firewall add rule name="FTP Service" action=allow service=ftpsvc protocol=TCP dir=in

netsh advfirewall set global StatefulFTP disable

The Firewall interface has an FTP service rule, as shown below.

This rule will permit connections to the server’s FTP service from any IP address.

[Looking for a solution to another query? We are just a click away.]

Conclusion

So, to sum up, FTP also supports a “passive” operational mode where the client starts the data channel connection. We can limit the port range that the FTP service uses to increase server security and then create a firewall rule that only permits FTP traffic on the permitted port numbers.