Rotten mud: firewall configuration enabled on the FTP server

Last Update:2014-07-05 Source: Internet

Author: User

Tags ftp client filezilla ftp protocol

Developer on Alibaba Coud: Build your first app with APIs, SDKs, and tutorials on the Alibaba Cloud. Read more ＞

This article is first published in the dark world.

The most recent server of the company needs to enable the FTP service to transfer files.

However, considering that the server is on the public network, firewall is usually enabled for security considerations. In general, I disable the firewall for FTP servers in the company.

Below I will flow out the firewall configuration as follows:

OS: Windows Server 2003, 2008 ftp: filezilla server 0.9.41

The first step is to install the FTP server. In this scenario, the open-source FTP server filezill server is used. For installation and use of filezilla server, you can go to Baidu. There are many articles on the Internet. I will not discuss it here.

FTP transmission is special, unlike other protocols that use a port. The FTP protocol requires two ports, one of which is port 21, which is used to transmit related commands. One is the data port. The default port is Port 20, which is used to transmit file data.

Therefore, we need to open two ports 21 and 20 on the firewall.

After all, it is transmitted over the public network, so we have to consider the security. Here we change the FTP ports to 2121 and 6650. In addition, only the specified IP address can be used to connect to the FTP server.

For example:

650) This. width = 650; "Title =" image "style =" border-right-width: 0px; Background-image: none; border-bottom-width: 0px; float: none; padding-top: 0px; padding-left: 0px; margin-left: auto; padding-Right: 0px; border-top-width: 0px; margin-Right: auto; "Border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201407/5/526870_1404560742HRNV.png "width =" 820 "Height =" 488 "/>

Now the firewall is enabled. Let's connect to it remotely.

The FTP server cannot be connected.

Now we open ports 2121 and 6650 on the firewall, as shown below:

Now we connect to the FTP server, for example:

We can see that the FTP client has successfully connected to the FTP server.

The above firewall is operated on Windows Server 2003. Let's take a look at the firewall settings on Windows Server 2008.

In the firewall rule options, we only need to configure inbound rules. For example:

In inbound rules, port 6650 is opened in the same way.

The preceding figure shows how to open the corresponding port on the firewall. Next we will configure the specified IP address to connect to the FTP server.

In fact, there are two ways to specify an IP address to connect to the FTP server. One is to set the IP address on filezilla server, and the other is the key firewall in this article.

First, let's take a look at how to set up filezilla server. Open filezilla server and select a global configuration item. IP Filter is very important.

Fill in the upper half of the IP Filter with the IP address that cannot be connected, and the lower half with the IP address that can be connected to the FTP server. By default, all IP addresses cannot connect to the FTP server. Therefore, fill in "*" in the upper part. For example:

Now let's try to connect. My local public IP address is:

I cannot connect to the FTP server locally. So can the allowed IP addresses be connected? For example:

We can see that the connection is successful.

These are the IP address filtering settings of the filezilla server. Next we will not use filezilla server settings, but firewall settings.

Enable the ports 2121 and 6650 configured by the firewall, for example:

Click "change range"-"custom list", and fill in the IP addresses allowed for access in the custom list. For example:

After the above firewall settings are complete, let's test the connection.

I can see that I still cannot connect to the FTP server locally. What is the allowed IP address? For example:

We can see that the allowed IP Address can connect to the FTP server.

Through the above experiments, we can know. If we have special requirements, for example, the port 80 of the Open Server can only be accessed by the specified IP address, which improves the security of related applications.

Especially for servers with port 3389 enabled, we can use this method to reduce the possibility of server attacks.

PS: Since version 0.9.42, filezilla server does not support Windows Server 2003.

This article from the "muddy world" blog, please be sure to keep this source http://ilanni.blog.51cto.com/526870/1434874

This article is an English version of an article which is originally in the Chinese language on aliyun.com and is provided for information purposes only. This website makes no representation or warranty of any kind, either expressed or implied, as to the accuracy, completeness ownership or reliability of the article or any translations thereof. If you have any concerns or complaints relating to the article, please send an email, providing a detailed description of the concern or complaint, to info-contact@alibabacloud.com. A staff member will contact you within 5 working days. Once verified, infringing content will be removed immediately.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

Get Started for Free

Sales Support

1 on 1 presale consultation

Chat Contact Sales
After-Sales Support

24/7 Technical Support 6 Free Tickets per Quarter Faster Response

Open a Ticket
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.

Learn More