Network Configuration: Difference between revisions

Latest revision as of 00:33, 29 September 2023

Setting up network components for FTP is not trivial for use outside your LAN (Local Area Network). Since so many firewalls and routers exist, it is impractical to give detailed step-by-step instructions suitable for every user. It is important to understand the basics of the FTP protocol in order to configure FileZilla and the routers and/or firewalls involved. This documentation describes the history of the FTP and how some aspects of the protocol work. Reading it carefully will save you a lot of trouble setting up FTP.

Background

This section provides an overview of the historical and technical background of the FTP protocol. For detailed in-depth information see specifications.

Historical Background

In the fast living world of the internet, the File Transfer Protocol is not just old, it's ancient. Early drafts of the protocol go back as far as 1971, and the current specifications are from 1985. The protocol might even be older than you!

Back then, the Internet was mainly used by universities and research centers. The community was small, many users knew each other and all were collaborating together. The internet was a friendly, trusting place. Security was not much of a concern.

A lot has changed since then. The Internet is now ubiquitous, with millions of users communicating with each other in many different ways. It is also a more hostile place. The availability and openness has attracted malicious users who exploit design limitations, incomplete implementations, bugs, and the inexperience of other users.

Several attempts have been made to address these problems:

NAT (Network Address Translation) routers. Many hosts and routers on the internet use the IPv4 protocol. The number of hosts connected to the internet has reached IPV4's design limit for the number of addresses (IPv6 is designed to relieve this). NAT routers allow multiple systems within a LAN to connect to the outside world with one external IP address.
Personal firewalls try to protect personal computers from attacks by malicious users.

Unfortunately, both NAT and personal firewalls conflict with FTP more often than not. To make things worse, some are themselves flawed, causing additional problems regarding FTP.

Technical background

What distinguishes FTP from most other protocols is the use of secondary connections for file transfers. When you connect to an FTP server, you are actually making two connections. First, the so-called control connection is established, over which FTP commands and their replies are transferred. Then, in order to transfer a file or a directory listing, the client sends a particular command over the control connection to establish the data connection.

The data connection can be established two different ways, using active mode or passive mode.

In passive mode, which is recommended (see below), the client sends the PASV command to the server, and the server responds with an address. The client then issues a command to transfer a file or to get a directory listing, and establishes a secondary connection to the address returned by the server.

In active mode, the client opens a socket on the local machine and tells its address to the server using the PORT command. Once the client issues a command to transfer a file or listing, the server will connect to the address provided by the client.

In both cases, the actual file or listing is then transferred over the data connection.

Generally, establishing outgoing connections requires less configuration on the routers/firewalls involved than establishing incoming connections. In passive mode, the connection is outgoing on the client side and incoming on the server side and in active mode this is reversed. Note that the only differences are in establishing a connection. Once established, the connection can be used for uploads or downloads.

A common network setup might look like this:

In passive mode, the router and firewall on the server side need to be configured to accept and forward incoming connections. On the client side, however, only outgoing connections need to be allowed (which will already be the case most of the time).

Analogously, in active mode, the router and firewall on the client side need to be configured to accept and forward incoming connections. Only outgoing connections have to be allowed on the server side.

Since in most cases one server provides a service for many users, it is much easier to configure the router and firewall on the server side once for passive mode than to configure the client's router/firewall for each individual client in active mode. Therefore, passive mode is recommended in most cases.

NAT routers

Most broadband users will have a NAT (Network Address Translation) router between their computer and the internet. This may be a standalone router device (perhaps a wireless router), or be built into a DSL or cable modem. In a NAT environment, all systems behind the NAT router form a Local Area Network (LAN), and each system in the LAN has a local IP address (recognizable as four small numbers separated by dots. See Private addresses). The NAT router itself has a local IP address as well. In addition, the NAT router also has an external IP address by which it is known to the Internet.

An example system might look like this:

The internal IP addresses are only valid inside the LAN, since they would make little sense to a remote system. Think about a server behind a NAT router. Imagine what might happen if a client requests passive mode, but the server doesn't know the external IP address of the NAT router. If the server sends its internal address to the client, two things could happen:

If the client is not behind a NAT, the client would abort since the address is invalid.
If the client is behind a NAT, the address given by the server might be the same as a system in the client's own LAN.

Obviously, in both cases passive mode would be impossible.

So if a server is behind a NAT router, it needs to know the external IP address of the router in passive mode. In this case, the server sends the router's external address to the client. The client then establishes a connection to the NAT router, which in turn routes the connection to the server.

Firewalls

Personal firewalls are installed on many systems to protect users from security vulnerabilities in the operating system or applications running on it. Over the internet, malware such as worms try to exploit these flaws to infect your system. Firewalls can help to prevent such an infection. However, firewalls and other security applications can sometimes interfere with non-malicious file transfers.

Especially if using FTP, firewall users might occasionally see messages like this from their firewall:

Trojan Netbus blocked on port 12345 used by FileZilla.exe

In many cases, this is a false alarm. Any program can choose any port it wants for communication over the internet. FileZilla, then, might choose a port that is coincidentally also the default port of a trojan or some other malware being tracked by your firewall. FileZilla is clean of malware as long as it is downloaded from the official website.

Malicious routers, firewalls and data sabotage

Some routers and firewalls pretend to be smart. They analyze connections and, if they think they detect FTP, they silently change the data exchanged between client and server. If the user has not explicitly enabled this feature, this behavior is essentially data sabotage and can cause various problems.

For an example, imagine a client behind a NAT router trying to connect to the server. Let's further assume that this client does not know it is behind a NAT and wants to use active mode. So it sends the PORT command with the user's local, un-routable IP address to the server:

PORT 10,0,0,1,12,34

This command tells the server to connect to the address 10.0.0.1 on port 12*256+34 = 3106

The NAT router sees this and silently changes the command to include the external IP address. At the same time, the NAT router will also create a temporary port forwarding for the FTP session, possibly on a different port even:

PORT 123,123,123,123,24,55

The above command tells the server to connect to the address 123.123.123.123 on port 24*256+55 = 6199

With this behavior, a NAT router allows an improperly configured client to use active mode.

So why is this behavior bad? Essentially, it can cause a number of problems if it is enabled by default, without explicit user consent. The FTP connections in their most basic form appear to work, but as soon as there's some deviation from the basic case, everything will fail, leaving the user stumped:

The NAT router blindly assumes some connection uses FTP based on criteria like target ports or the initial server response:
- The used protocol is detected as FTP, yet there is no guarantee that this is true (a false positive). Though unlikely, it is conceivable that a future revision of the FTP protocol might change the syntax of the PORT command. A NAT router modifying the PORT command would then silently change things it does not support and thus break the connection.
- The router's protocol detection can fail to recognize an FTP connection (a false negative). Say the router only looks at the target port, and if it is 21, it detects it as FTP. As such, active mode connections with an improperly configured client to servers running on port 21 will work, but connections to other servers on non-standard ports will fail.
Obviously, a NAT router can no longer tamper with the connection as soon as an encrypted FTP session is used, again leaving the user clueless why it works for normal FTP but not for encrypted FTP.
Say a client behind a NAT router sends "PORT 10,0,0,1,12,34". How does the NAT router know the client is improperly configured? It is also possible that the client is properly configured, yet merely wants to initiate an FXP (server-to-server) transfer between the server it is connected to and another machine in the server's own local network.

Therefore, having protocol specific features enabled in a NAT router by default can create significant problems. The solution to all this, then, is to know your router's settings, and to know the configuration abilities of a router before you set it up. A good NAT router should always be fully protocol-agnostic. The exception is if you as the user have explicitly enabled this feature, knowing all its consequences.

While this section only discussed the combination of a NAT router on the client side with active mode, the same applies to a server behind a NAT router and the reply to the PASV command.

Setting up FileZilla Client

If you're running FileZilla 3, it's recommended you run the network configuration wizard. It will guide you through the necessary steps and can test your configuration after set-up.

Obviously, if you want to connect to any server, you need to tell your firewall that FileZilla should be allowed to open connections to other servers. Most normal FTP servers use port 21, SFTP servers use port 22 and FTP over TLS (implicit mode) use port 990 by default. These ports are not mandatory, however, so it's best to allow outgoing connections to arbitrary remote ports.

Since many servers on the internet are misconfigured and don't support both transfer modes, it's recommended that you configure both transfer modes on your end.

Passive mode

In passive mode, the client has no control over what port the server chooses for the data connection. Therefore, in order to use passive mode, you'll have to allow outgoing connections to all ports in your firewall.

Active mode

In active mode, the client opens a socket and waits for the server to establish the transfer connection.

By default, FileZilla Client asks the operating system for the machine's IP address and for the number of a free port. This configuration can only work if you are connected to the internet directly without any NAT router, and if you have set your firewall to allow incoming connections on all ports greater than 1024.

If you have a NAT router, you need to tell FileZilla your external IP address in order for active mode connections to work with servers outside your local network:

If you have a fixed external IP address, you can enter it in FileZilla's configuration dialog.
If you have a dynamic IP address, you can authorize FileZilla to obtain your external IP address from a special website. This will occur automatically each time FileZilla is started. No information will be submitted to the website (regardless of FileZilla version).

If in doubt, use the second option.

If you do not want to allow incoming connections on all ports, or if you have a NAT router, you need to tell FileZilla to use a specific range of ports for active mode connections. You will have to open these ports in your firewall. If you have a NAT router, you need to forward these ports to the local machine FileZilla is installed on. Depending on your router model, you can either forward a range of ports or you need to forward all ports individually.

Valid ports can be from 1 to 65535; however, ports less than 1024 are reserved for other protocols. It is best to choose ports greater than or equal to 50000 for active mode FTP. Due to the nature of TCP (the underlying transport protocol), a port cannot be reused immediately after each connection. Therefore, the range of ports should not be too small to prevent the failure of transfers of multiple small files. A range of 50 ports should be sufficient in most cases.

Setting up and testing FileZilla Server

Warning: The content of this section is outdated and needs to be adapted to apply to FileZilla Server version 1.x

Setting up the server is very similar to setting up the client, with the main difference being that the roles of active and passive mode are reversed.

A common mistake, especially by users with NAT routers, is in testing the server. If you are within your local network, you can only test using the local IP address of the server. Using the external address from the inside will probably fail, and one of the following may happen:

It actually works (surprisingly - and it probably means something else is wrong ...)
The router blocks access to its own external address from the inside, due to identifying it as a possible attack
The router forwards the connection to your ISP, which then blocks it as a possible attack

Even if the test works, there is no guarantee that an external user can really connect to your server and transfer files. The only reliable way to test your server is to try connecting from an external system, outside of your LAN.

Active mode

Make sure FileZilla Server is allowed to establish outgoing connections to arbitrary ports, since the client controls which port to use.

On the local end of the connection, FileZilla Server tries to use a port one less than that of the control connection (e.g. port 20 if server is listening on port 21). However, this is not always possible - so don't rely on it.

Passive mode

The server configuration is very similar to client configuration for active mode. In passive mode, the server opens a socket and waits for the client to connect to it.

By default, FileZilla Server asks the operating system for the machine's IP address, and for a free port number. This configuration can only work if you are connected to the internet directly without any NAT router and if you have set your firewall to allow incoming connections on all ports greater than 1024.

If you have a NAT router, you need to tell FileZilla Server your external IP address or passive mode connections will not work with clients outside your local network:

If you have a fixed external IP address, you can enter it in the configuration dialog of FileZilla Server.
If you have a dynamic IP address, you can let FileZilla Server obtain your external IP address from a special website automatically. Except your version of FileZilla Server, no information will be submitted to that website.

If in doubt, use the second option.

If you do not want to allow incoming connections on all ports, or if you have a NAT router, you need to tell FileZilla Server to use a specific range of ports for passive mode connections. You will have to open these ports in your firewall. If you have a NAT router, you need to forward these ports to the local machine FileZilla Server is installed on. Depending on your router model, you can either forward a range of ports or you need to forward all ports individually.

Valid ports can be from 1 to 65535, however ports less than 1024 are reserved for other protocols. It is best to choose ports >= 50000 for passive mode FTP. Due to the nature of TCP (the underlying transport protocol), a port cannot be reused immediately after each connection. Hence the range of ports should not be too small or transfers of multiple small files can fail. A range of 50 ports should be sufficient in most cases.

Troubleshooting

The following are a few troubleshooting suggestions:

Unfortunately, many personal firewalls and consumer routers are flawed or in some cases, even actively sabotage FTP (e.g. SMC Barricade V1.2). First of all, as with all software, you should keep everything updated. This includes the firewall software as well as the firmware version of your router.

If that does not help, you might want to try to uninstall your firewall to see what happens. Simply disabling your firewall might not work, as some firewalls cannot be fully disabled. In particular, most firewalls install virtual device drivers which cannot be disabled other than by uninstalling them. Also check for hidden firewalls. Programs such as virus scanners often have firewall functionality as well.

If possible, try to connect directly to the internet without a router by plugging your computer directly into your modem. If you have a combination modem/router device, try putting it into bridge mode to disable the routing part.

If you are trying to setup a server and it works fine within your LAN but is not reachable from the outside, try changing the listening port. Some ISPs don't like their customers to host servers and they may block ports with numbers under 1024.

Another issue may occur if you are hosting an FTP server on default port 21. There might be a firewall at the ISP side of your connection which can do odd things like changing the port for PASV commands. Try using another non-default port for your FTP server.

If you encounter "cannot open data connection" on a random basis (i.e., the ftp client can connect to the ftp server without problem for many connections until it encounters this problem), one possible reason may be that your client PC anti-virus software is configured to block outgoing connections on certain ranges of ports. When your ftp connections are running in pasv mode, the client-side outgoing ports are selected randomly and some of those randomly selected ports may be blocked by the anti-virus software. To identify this problem, read your anti-virus log on the client. In general, any software that can block certain ranges of outgoing ports (such as PC firewalls) can cause similar FTP grief.

Timeouts on large files

If you can transfer small files without any issues, but transfers of larger files end with a timeout, a broken router and/or firewall exists between the client and the server and is causing a problem.

As mentioned above, FTP uses two TCP connections: a control connection to submit commands and receive replies, and a data connection for actual file transfers. It is the nature of FTP that during a transfer the control connection stays completely idle.

The TCP specifications do not set a limit on the amount of time a connection can stay idle. Unless explicitly closed, a connection is assumed to remain alive indefinitely. However, many routers and firewalls automatically close idle connections after a certain period of time. Worse, they often don't notify the user, but just silently drop the connection. For FTP, this means that during a long transfer the control connection can get dropped because it is detected as idle, but neither client nor server are notified. So when all data has been transferred, the server assumes the control connection is alive and it sends the transfer confirmation reply. Likewise, the client thinks the control connection is alive and it waits for the reply from the server. But since the control connection got dropped without notification, the reply never arrives and eventually the connection will timeout.

In an attempt to solve this problem, the TCP specifications include a way to send keep-alive packets on otherwise idle TCP connections, to tell all involved parties that the connection is still alive and needed. However, the TCP specifications also make it very clear that these keep-alive packets should not be sent more often than once every two hours. Therefore, with added tolerance for network latency, connections can stay idle for up to 2 hours and 4 minutes.

However, many routers and firewalls drop connections that have been idle for less than 2 hours and 4 minutes. This violates the TCP specifications (RFC 5382 makes this especially clear). In other words, all routers and firewalls that are dropping idle connections too early cannot be used for long FTP transfers. Unfortunately manufacturers of consumer-grade router and firewall vendors do not care about specifications ... all they care about is getting your money (and only deliver barely working lowest quality junk).

To solve this problem, you need to uninstall affected firewalls and replace faulty routers with better-quality ones.

Setting up FileZilla Server with Windows Firewall

If you are having problems with setting up FileZilla Server to run behind Windows Firewall (specifically, it fails on "List" and the client receives a "Failed to receive directory listing" error), you must add the FileZilla Server application to Windows Firewall's Exceptions list. To do this, follow these steps:

Open Windows Firewall under Control Panel.
If using Vista, click "Change Settings"
Select the "Exceptions" tab.
Click "Add program..."
Do NOT select "FileZilla Server Interface" from the list, instead click on "Browse..."
Locate the directory you installed FileZilla Server to (normally "C:\Program Files\FileZilla Server\")
Double click or select "FileZilla server.exe" and press open (Once again, NOT "FileZilla Server Interface.exe")
Select "FileZilla server.exe" from the list and click "Ok"
Verify that "FileZilla server.exe" is added to the exceptions list and that it has a check mark in the box next to it
Press "Ok" to close the window
Open a command prompt with administrative rights and execute the following command: netsh advfirewall set global statefulftp disable

Passive mode should now work. If you are still having problems connecting (from another computer or outside the network), check your router settings or try to add the port number in the Windows Firewall settings located in the Exceptions tab.

See the Microsoft kb article 931130 about running FileZilla with the "Routing and Remote Access" or the "Application Layer Gateway" service enabled. http://support.microsoft.com/kb/931130

Setting up FileZilla Server with Windows 8 Firewall

These are the instructions if your operating system is Windows 8 - the interface is slightly different from that described above in Setting up FileZilla Server with Windows Firewall.

Under Windows 8 you must allow the FileZilla Server application through Windows Firewall. To do this, follow these steps:

Move mouse to upper right corner and click the magnifying glass search icon, and type "firewall" (without the double quotes) in the Search box and then click the "Settings" text. Or, hold down the Windows logo key on the keyboard and press the I key, select the text "Control Panel" and press Enter, in the Search Control Panel area at top right type "firewall". In either case, now click the "Allow an app through Windows Firewall" that should appear.

Click "Change Settings" and a new button should appear titled "Allow another app..."
Click "Allow another app..."
A window titled "Add an app" should appear; do not do anything in this step.
Do NOT select "FileZilla Server Interface" from the list, instead click on "Browse..."
Locate the directory you installed FileZilla Server to (normally "C:\Program Files\FileZilla Server\")
Double click or select "FileZilla server.exe" and press open (Once again, NOT "FileZilla Server Interface.exe")
Your mouse pointer should now return to the "Add an app" window; scroll down the list and select "FileZilla server.exe" and click "Add".
Your mouse pointer should now return to the Windows Firewall Allowed apps window; verify that "FileZilla server.exe" is added to the allowed apps and features list and that it has a check mark in either the Private box or the Public box. Choose Private if you want the server accessible only from within your local network, and choose Public if you want the server accessible from outside your local network (this might include clients connected wirelessly to your network).
Press "Ok" to close the Windows Firewall window
Open a command prompt with administrative rights and execute the following command: netsh advfirewall set global statefulftp disable

If you are still having problems see the advice at the end of section Setting up FileZilla Server with Windows Firewall above or search Microsoft Knowledge base for Firewall related articles.

Network Configuration: Difference between revisions

Latest revision as of 00:33, 29 September 2023

Contents

Background

Historical Background

Technical background

NAT routers

Firewalls

Malicious routers, firewalls and data sabotage

Setting up FileZilla Client

Passive mode

Active mode

Setting up and testing FileZilla Server

Active mode

Passive mode

Troubleshooting

Timeouts on large files

Setting up FileZilla Server with Windows Firewall

Setting up FileZilla Server with Windows 8 Firewall

Navigation menu

Page actions

Page actions

Personal tools

Navigation

Search

Tools

@@ Line 1: / Line 1: @@
-Mise en place d' éléments de réseau pour le FTP n'est pas négligeable pour une utilisation en dehors de votre réseau LAN (Local Area Network) . Depuis pare-feu et routeurs tant existent , il est impossible de donner des instructions détaillées étape par étape adapté à chaque utilisateur. Il est important de comprendre les bases du protocole FTP afin de configurer FileZilla et les routeurs et / ou pare-feu en cause.
+Setting up network components for FTP is not trivial for use outside your LAN (Local Area Network). Since so many firewalls and routers  exist, it is impractical to give detailed step-by-step instructions suitable for every user. It is important to understand the basics of the FTP protocol in order to configure FileZilla and the routers and/or firewalls involved.
-Ce document décrit l'histoire du protocole FTP et comment certains aspects de l'œuvre du protocole . En le lisant attentivement vous permettra d'économiser beaucoup de mal à mettre en place FTP .
+This documentation describes the history of the FTP and how some aspects of the protocol work. Reading it carefully will save you a lot of trouble setting up FTP.
-Contexte == ==
+== Background ==
-Cette section donne un aperçu du contexte historique et technique du protocole FTP . Pour des informations détaillées en profondeur voir [ [ File Transfer Protocol spécifications | ] ] .
+This section provides an overview of the historical and technical background of the FTP protocol. For detailed in-depth information see [[File Transfer Protocol|specifications]].
-=== Historique ===
+=== Historical Background ===
-Dans le monde vivant rapide de l'Internet , le File Transfer Protocol n'est pas vieux , il est ancienne . Les premières versions du protocole de remonter aussi loin que 1971 , et les spécifications actuelles sont de 1985 . Le protocole peut-être même plus que vous !
+In the fast living world of the internet, the File Transfer Protocol is not just old, it's ancient. Early drafts of the protocol go back as far as 1971, and the current specifications are from 1985. The protocol might even be older than you!
-À l'époque , l'Internet était principalement utilisé par les universités et centres de recherche . La communauté est petite , de nombreux utilisateurs se connaissaient et tous ont collaboré ensemble. L'Internet a été un match amical , le lieu de confiance. De sécurité n'a pas beaucoup d'inquiétude .
+Back then, the Internet was mainly used by universities and research centers. The community was small, many users knew each other and all were collaborating together. The internet was a friendly, trusting place. Security was not much of a concern.
-Beaucoup de choses ont changé depuis lors . L'Internet est aujourd'hui partout , avec des millions d'utilisateurs de communiquer entre eux de différentes manières .
+A lot has changed since then. The Internet is now ubiquitous, with millions of users communicating with each other in many different ways.
-Il est également un endroit plus hostile. La disponibilité et l'ouverture a attiré des utilisateurs malveillants qui exploitent les limites de conception , implémentation incomplète , bugs , et l'inexpérience des autres utilisateurs. Une société de logiciels bien connus situés à Redmond , WA certainement joué un rôle dans ce domaine.
+It is also a more hostile place. The availability and openness has attracted malicious users who exploit design limitations, incomplete implementations, bugs, and the inexperience of other users.
-Plusieurs tentatives ont été faites pour résoudre ces problèmes :
+Several attempts have been made to address these problems:
-* [ http://en.wikipedia.org/wiki/Network_address_translation NAT ] ( Network Address Translation) routeurs . Beaucoup d'hôtes et les routeurs sur Internet utilisent le [ http://en.wikipedia.org/wiki/IPv4 IPv4 Protocole] . Le nombre d'hôtes connectés à l' Internet est à la limite de conception IPV4 pour le nombre d'adresses ( [ http://en.wikipedia.org/wiki/IPv6 IPv6 ] est conçu pour soulager cette ) . routeurs NAT permet de multiples systèmes sur un réseau local pour se connecter au monde extérieur avec une adresse IP externe.
+* [http://en.wikipedia.org/wiki/Network_address_translation NAT] (Network Address Translation) routers. Many hosts and routers on the internet use the [http://en.wikipedia.org/wiki/IPv4 IPv4] protocol. The number of hosts connected to the internet has reached IPV4's design limit for the number of addresses ([http://en.wikipedia.org/wiki/IPv6 IPv6] is designed to relieve this). NAT routers allow multiple systems within a LAN to connect to the outside world with one external IP address.
-* [ http://en.wikipedia.org/wiki/Personal_firewall pare-feu personnels ] essayer de protéger les ordinateurs personnels contre les attaques par des utilisateurs malveillants .
+* [http://en.wikipedia.org/wiki/Personal_firewall Personal firewalls] try to protect personal computers from attacks by malicious users.
-Malheureusement, les deux NAT et pare-feu personnels conflit avec FTP le plus souvent . Pour aggraver les choses , certains sont eux-mêmes défauts , ce qui provoque des problèmes supplémentaires concernant les FTP .
+Unfortunately, both NAT and personal firewalls conflict with FTP more often than not. To make things worse, some are themselves flawed, causing additional problems regarding FTP.
-=== === information technique
+=== Technical background ===
-Ce qui distingue de la plupart des protocoles FTP autre est l'utilisation de connexions secondaires pour les transferts de fichiers . Lorsque vous vous connectez à un serveur FTP , vous êtes effectivement faire deux connexions . Tout d'abord, la soi-disant '' '' connexion de contrôle est établi , sur lequel les commandes FTP et leurs réponses sont transférés . Puis , afin de transférer un fichier ou un répertoire, le client envoie une commande en particulier sur la connexion de contrôle pour établir la connexion '' '' de données.
+What distinguishes FTP from most other protocols is the use of secondary connections for file transfers. When you connect to an FTP server, you are actually making two connections. First, the so-called ''control connection'' is established, over which FTP commands and their replies are transferred. Then, in order to transfer a file or a directory listing, the client sends a particular command over the control connection to establish the ''data connection''.
-La connexion de données peut être établie de deux façons différentes , en utilisant le mode actif '' '''' ''ou en mode passif.
+The data connection can be established two different ways, using ''active mode'' or ''passive mode''.
-En mode passif , ce qui est recommandé ( voir ci-dessous ) , le client envoie la commande PASV sur le serveur et le serveur répond avec une adresse . Le client émet alors une commande pour transférer un fichier ou pour obtenir une liste des répertoires , et établit une connexion secondaire par rapport à l'adresse renvoyée par le serveur .
+In passive mode, which is recommended (see below), the client sends the PASV command to the server, and the server responds with an address. The client then issues a command to transfer a file or to get a directory listing, and establishes a secondary connection to the address returned by the server.
-En mode actif , le client ouvre un socket sur la machine locale et indique son adresse au serveur en utilisant la commande PORT . Une fois que le client émet une commande pour transférer un fichier ou une liste , le serveur se connecte à l'adresse fournie par le client .
+In active mode, the client opens a socket on the local machine and tells its address to the server using the PORT command. Once the client issues a command to transfer a file or listing, the server will connect to the address provided by the client.
-Dans les deux cas , le fichier réel ou annonce est ensuite transféré sur la connexion de données .
+In both cases, the actual file or listing is then transferred over the data connection.
-En règle générale , l'établissement de connexions sortantes nécessite moins de configuration sur les routeurs / pare-feu impliqués que d'établir les connexions entrantes . En mode passif , la connexion est sortante sur le côté client et entrant sur le côté serveur . En mode actif , les rôles sont inversés : la connexion de données entrants sur le côté client et sortant sur le côté serveur .
+Generally, establishing outgoing connections requires less configuration on the routers/firewalls involved than establishing incoming connections. In passive mode, the connection is outgoing on the client side and incoming on the server side and in active mode this is reversed.
-Notez que les seules différences sont l'établissement de connexions . Une fois établie, la connexion de données peut être utilisée pour des téléchargements ou des téléchargements.
+Note that the only differences are in establishing a connection. Once established, the connection can be used for uploads or downloads.
-Une configuration réseau commun pourrait ressembler à ceci :
+A common network setup might look like this:
-[ [Image : FTP1.png | center]]
+[[Image:FTP1.png|center]]
-En mode passif , le routeur et pare-feu sur le côté serveur doit être configuré pour accepter les connexions entrantes et l'avant . Sur le côté client , cependant, que les connexions sortantes doivent être autorisés ( qui sera déjà le cas la plupart du temps ) .
+In passive mode, the router and firewall on the server side need to be configured to accept and forward incoming connections. On the client side, however, only outgoing connections need to be allowed (which will already be the case most of the time).
-De la même façon , en mode actif , le routeur et pare-feu sur le côté client doivent être configuré pour accepter les connexions entrantes et transmettre . Seules les connexions sortantes doivent être autorisés sur le côté serveur .
+Analogously, in active mode, the router and firewall on the client side need to be configured to accept and forward incoming connections. Only outgoing connections have to be allowed on the server side.
-Comme dans la plupart des cas un serveur fournit un service pour de nombreux utilisateurs , il est beaucoup plus facile à configurer le routeur et pare-feu sur le côté serveur une fois pour le mode passif que de configurer le routeur du client / pare-feu pour chaque client en mode actif . Par conséquent , le mode passif est recommandée dans la plupart des cas .
+Since in most cases one server provides a service for many users, it is much easier to configure the router and firewall on the server side once for passive mode than to configure the client's router/firewall for each individual client in active mode. Therefore, passive mode is recommended in most cases.
-routeurs NAT ==== ====
+==== NAT routers ====
-La plupart des utilisateurs de large bande aura un NAT ( Network Address Translation) routeur entre son ordinateur et l'Internet . Ce peut être un dispositif autonome routeur (peut-être un routeur sans fil ) , ou être intégré à un modem DSL ou câble . Dans un environnement NAT , tous les systèmes de derrière le routeur NAT forme un'' Local Area Network (LAN ) '', et chaque système dans le réseau local a une adresse IP locale (reconnaissable que quatre petits nombres séparés par des points ) . Le routeur NAT lui-même a une adresse IP locale ainsi . En outre , le routeur NAT a également une adresse IP externe par lequel il est connu de l'Internet .
+Most broadband users will have a NAT (Network Address Translation) router between their computer and the internet. This may be a standalone router device (perhaps a wireless router), or be built into a DSL or cable modem. In a NAT environment, all systems behind the NAT router form a ''Local Area Network (LAN)'', and each system in the LAN has a local IP address (recognizable as four small numbers separated by dots. See [http://en.wikipedia.org/wiki/Private_network Private addresses]). The NAT router itself has a local IP address as well. In addition, the NAT router also has an external IP address by which it is known to the Internet.
-Un exemple de système pourrait ressembler à ceci :
+An example system might look like this:
-[ [Image : FTP2.png | center]]
+[[Image:FTP2.png|center]]
-Les adresses IP internes ne sont valables à l'intérieur du LAN , puisqu'ils ont peu de sens à un système distant . Pensez à un serveur derrière un routeur NAT . Imaginez ce qui pourrait arriver si un client demande le mode passif , mais le serveur ne connaît pas l' adresse IP externe du routeur NAT . Si le serveur envoie son adresse interne au client , deux choses peuvent se produire :
+The internal IP addresses are only valid inside the LAN, since they would make little sense to a remote system. Think about a server behind a NAT router. Imagine what might happen if a client requests passive mode, but the server doesn't know the external IP address of the NAT router. If the server sends its internal address to the client, two things could happen:
-* Si le client n'est pas derrière un NAT , le client avorter car l'adresse est invalide .
+* If the client is not behind a NAT, the client would abort since the address is invalid.
-* Si le client est derrière un NAT , l'adresse donnée par le serveur peut être le même que dans un système propre réseau local du client .
+* If the client is behind a NAT, the address given by the server might be the same as a system in the client's own LAN.
-De toute évidence, dans les deux cas le mode passif serait impossible .
+Obviously, in both cases passive mode would be impossible.
-Donc, si un serveur est derrière un routeur NAT , il faut connaître l'adresse IP externe du routeur en mode passif . Dans ce cas, le serveur envoie l'adresse externe du routeur pour le client. Le client établit alors une connexion vers le routeur NAT , qui, dans les routes tourner la connexion au serveur .
+So if a server is behind a NAT router, it needs to know the external IP address of the router in passive mode. In this case, the server sends the router's external address to the client. The client then establishes a connection to the NAT router, which in turn routes the connection to the server.
-Firewalls === ===
+=== Firewalls ===
-'' '' pare-feu personnels sont installés sur de nombreux systèmes pour protéger les utilisateurs contre des vulnérabilités de sécurité dans le système d'exploitation ou des applications tournant sur elle . Sur Internet , les logiciels malveillants tels que les vers essayer d'exploiter ces failles pour infecter votre système . Les pare-feu peut aider à prévenir une telle infection . Cependant , les firewalls et autres applications de sécurité peuvent parfois interférer avec les transferts de fichiers non malveillants .
+''Personal firewalls'' are installed on many systems to protect users from security vulnerabilities in the operating system or applications running on it. Over the internet, malware such as worms try to exploit these flaws to infect your system. Firewalls can help to prevent such an infection. However, firewalls and other security applications can sometimes interfere with non-malicious file transfers.
-Surtout si vous utilisez FTP , les utilisateurs de pare-feu peut parfois voir des messages comme celui-ci de leur pare-feu :
+Especially if using FTP, firewall users might occasionally see messages like this from their firewall:
- Trojan Netbus bloqués sur le port 12345 utilisé par FileZilla.exe
+ Trojan Netbus blocked on port 12345 used by FileZilla.exe
-Dans de nombreux cas , il s'agit d' une fausse alerte . N'importe quel programme peut choisir n'importe quel port il veut pour la communication sur Internet . FileZilla , puis , peut choisir un port qui est aussi par coïncidence le port par défaut d'un cheval de Troie ou autres logiciels malveillants certains étant suivis par votre pare-feu . FileZilla est propre de malwares '' aussi longtemps qu'il est téléchargé à partir du site officiel '' .
+In many cases, this is a false alarm. Any program can choose any port it wants for communication over the internet. FileZilla, then, might choose a port that is coincidentally also the default port of a trojan or some other malware being tracked by your firewall. FileZilla is clean of malware ''as long as it is downloaded from the official website''.
-=== malveillants routeurs , pare-feu et le sabotage de données ===
+=== Malicious routers, firewalls and data sabotage ===
-Certains routeurs et pare-feu semblant d'être intelligent. Ils analysent les connexions et , s'ils croient déceler FTP , ils silencieusement changer les données échangées entre le client et le serveur. Si l'utilisateur n'a pas explicitement activé cette fonctionnalité , ce comportement est essentiellement le sabotage de données et peut causer divers problèmes.
+Some routers and firewalls pretend to be smart. They analyze connections and, if they think they detect FTP, they silently change the data exchanged between client and server. If the user has not explicitly enabled this feature, this behavior is essentially data sabotage and can cause various problems.
-Pour un exemple , imaginez un client derrière un routeur NAT tente de se connecter au serveur . Let's supposons en outre que ce client ne sait pas qu'il est derrière un NAT et veut utiliser le mode actif. Ainsi, il envoie la commande PORT avec local de l'utilisateur , l'adresse IP non routable sur le serveur :
+For an example, imagine a client behind a NAT router trying to connect to the server. Let's further assume that this client does not know it is behind a NAT and wants to use active mode. So it sends the PORT command with the user's local, un-routable IP address to the server:
- PORT 10,0,0,1,12,34
+ PORT 10,0,0,1,12,34
-Cette commande indique au serveur de se connecter à l'adresse 10.0.0.1 sur le port 12 * 256 = 3106 34
+This command tells the server to connect to the address 10.0.0.1 on port 12*256+34 = 3106
-Le routeur NAT voit dans cette évolution et en silence la commande à inclure l'adresse IP externe . Dans le même temps , le routeur NAT va également créer une redirection de port temporaire pour la session FTP , éventuellement sur un autre port même :
+The NAT router sees this and silently changes the command to include the external IP address. At the same time, the NAT router will also create a temporary port forwarding for the FTP session, possibly on a different port even:
- PORT 123,123,123,123,24,55
+ PORT 123,123,123,123,24,55
-La commande ci-dessus indique au serveur de se connecter à l'adresse 123.123.123.123 sur le port 24 * 256 = 6199 55
+The above command tells the server to connect to the address 123.123.123.123 on port 24*256+55 = 6199
-Avec ce comportement , un routeur NAT permet à un client mal configuré pour utiliser le mode actif.
+With this behavior, a NAT router allows an improperly configured client to use active mode.
-Alors, pourquoi est-ce un mauvais comportement ? Essentiellement , il peut causer un certain nombre de problèmes si elle est activée par défaut , sans le consentement explicite de l'utilisateur . Les connexions FTP dans leur forme la plus simple semble fonctionner, mais dès qu'il ya un certain écart de l'affaire de base, tout ce qui sera un échec, laissant l'utilisateur perplexe :
+So why is this behavior bad? Essentially, it can cause a number of problems if it is enabled by default, without explicit user consent. The FTP connections in their most basic form appear to work, but as soon as there's some deviation from the basic case, everything will fail, leaving the user stumped:
-* Le routeur NAT prend aveuglément certaines utilisations de connexion FTP en fonction de critères tels que les ports cible ou la réponse initiale du serveur :
+* The NAT router blindly assumes some connection uses FTP based on criteria like target ports or the initial server response:
-** Le protocole utilisé est détecté comme FTP , mais il n'ya aucune garantie que cela est vrai ( un'' faux '' positive ) . Bien que peu probable , il est concevable que d'une future révision du protocole FTP pourrait changer la syntaxe de la commande PORT . Un routeur NAT modifier la commande PORT alors silencieusement changer les choses il ne supporte pas et donc rompre la liaison .
+** The used protocol is detected as FTP, yet there is no guarantee that this is true (a ''false positive''). Though unlikely, it is conceivable that a future revision of the FTP protocol might change the syntax of the PORT command. A NAT router modifying the PORT command would then silently change things it does not support and thus break the connection.
-** détection de protocole du routeur peut manquer de reconnaître une connexion FTP ( un'' faux '' négatif) . Dites le routeur ne regarde que le port cible , et si elle est de 21 , il le détecte comme FTP . En tant que tel , les connexions en mode actif avec un client mal configuré pour serveurs sur le port 21 va fonctionner, mais les connexions vers d'autres serveurs sur des ports non standards échouera.
+** The router's protocol detection can fail to recognize an FTP connection (a ''false negative''). Say the router only looks at the target port, and if it is 21, it detects it as FTP. As such, active mode connections with an improperly configured client to servers running on port 21 will work, but connections to other servers on non-standard ports will fail.
-* De toute évidence, un routeur NAT ne peut plus toucher à la connexion dès que une session cryptée FTP est utilisé , à nouveau en laissant l'utilisateur clueless pourquoi il travaille pour FTP normal , mais pas pour cryptée FTP .
+* Obviously, a NAT router can no longer tamper with the connection as soon as an encrypted FTP session is used, again leaving the user clueless why it works for normal FTP but not for encrypted FTP.
-* Dites un client derrière un routeur NAT envoie " PORT 10,0,0,1,12,34 " . Comment fonctionne le routeur NAT de connaissance du client est mal configuré ? Il est également possible que le client est correctement configuré , mais veut simplement d'ouvrir une FXP (serveur à serveur ) de transfert entre le serveur est connecté à une autre machine et dans le propre réseau local du serveur .
+* Say a client behind a NAT router sends "PORT 10,0,0,1,12,34". How does the NAT router know the client is improperly configured? It is also possible that the client is properly configured, yet merely wants to initiate an FXP (server-to-server) transfer between the server it is connected to and another machine in the server's own local network.
-Par conséquent , ayant des caractéristiques spécifiques du protocole est activé dans un routeur NAT par défaut peut créer des problèmes importants . La solution à tout cela , alors , est de savoir paramètres de votre routeur , et de connaître les capacités de configuration d'un routeur avant de le mettre en place . Un routeur NAT bonne devraient toujours être pleinement protocole agnostique. L'exception est si vous en tant qu'utilisateur ont explicitement activé cette fonctionnalité , sachant toutes ses conséquences.
+Therefore, having protocol specific features enabled in a NAT router by default can create significant problems. The solution to all this, then, is to know your router's settings, and to know the configuration abilities of a router before you set it up. A good NAT router should always be fully protocol-agnostic. The exception is if you as the user have explicitly enabled this feature, knowing all its consequences.
-Bien que cette section seulement discuté de la combinaison d'un routeur NAT sur le côté client en mode actif, la même chose s'applique à un serveur derrière un routeur NAT et la réponse à la commande PASV .
+While this section only discussed the combination of a NAT router on the client side with active mode, the same applies to a server behind a NAT router and the reply to the PASV command.
-== client FileZilla Mise en place ==
+== Setting up FileZilla Client ==
-Si vous utilisez FileZilla 3, il est recommandé d'exécuter l'Assistant de configuration réseau. Il vous guidera à travers les étapes nécessaires et pouvez tester votre configuration après l'installation.
+If you're running FileZilla 3, it's recommended you run the network configuration wizard. It will guide you through the necessary steps and can test your configuration after set-up.
-Évidemment, si vous voulez vous connecter à un serveur , vous devez dire à votre pare-feu que FileZilla devraient être autorisés à ouvrir des connexions vers d'autres serveurs . Normal, la plupart des serveurs FTP utilisent le port 21 , les serveurs SFTP utiliser le port 22 et FTP over SSL / TLS (mode implicite ) 990 Utilisez le port par défaut. Ces ports ne sont pas obligatoires , toutefois, il est préférable d' autoriser les connexions sortantes à l'arbitraire des ports éloignés .
+Obviously, if you want to connect to any server, you need to tell your firewall that FileZilla should be allowed to open connections to other servers. Most normal FTP servers use port 21, SFTP servers use port 22 and FTP over TLS (implicit mode) use port 990 by default. These ports are not mandatory, however, so it's best to allow outgoing connections to arbitrary remote ports.
-Depuis de nombreux serveurs sur Internet sont mal configurés et ne prend pas en charge les deux modes de transfert , il est recommandé de configurer les deux modes de transfert de votre côté .
+Since many servers on the internet are misconfigured and don't support both transfer modes, it's recommended that you configure both transfer modes on your end.
-=== === mode passif
+=== Passive mode ===
-En mode passif , le client n'a aucun contrôle sur ce que le port du serveur choisit pour la connexion de données . Par conséquent , afin d' utiliser le mode passif , vous devrez autoriser les connexions sortantes à tous les ports dans votre pare-feu .
+In passive mode, the client has no control over what port the server chooses for the data connection. Therefore, in order to use passive mode, you'll have to allow outgoing connections to all ports in your firewall.
-=== === mode actif
+=== Active mode ===
-En mode actif , le client ouvre un socket et attend que le serveur pour établir la connexion de transfert.
+In active mode, the client opens a socket and waits for the server to establish the transfer connection.
-Par défaut , FileZilla Client demande au système d'exploitation pour l'adresse IP de la machine et le numéro d'un port franc . Cette configuration ne peut fonctionner que si vous êtes connecté directement à Internet sans routeur NAT , et si vous avez configuré votre pare-feu pour autoriser les connexions entrantes sur tous les ports supérieurs à 1024 .
+By default, FileZilla Client asks the operating system for the machine's IP address and for the number of a free port. This configuration can only work if you are connected to the internet directly without any NAT router, and if you have set your firewall to allow incoming connections on all ports greater than 1024.
-Si vous avez un routeur NAT , vous devez dire à FileZilla votre adresse IP externe en vue pour les connexions en mode actif de travailler avec des serveurs en dehors de votre réseau local :
+If you have a NAT router, you need to tell FileZilla your external IP address in order for active mode connections to work with servers outside your local network:
-* Si vous avez une adresse IP externe fixe , vous pouvez l'entrer dans le dialogue de configuration de FileZilla est .
+* If you have a fixed external IP address, you can enter it in FileZilla's configuration dialog.
-* Si vous avez une adresse IP dynamique , vous pouvez autoriser FileZilla pour obtenir votre adresse IP externe à partir d'un site internet spécial. Cela se produit automatiquement chaque fois que FileZilla est démarré. Aucune information ne sera présenté sur le site ( quelle que soit la version FileZilla ) .
+* If you have a dynamic IP address, you can authorize FileZilla to obtain your external IP address from a special website. This will occur automatically each time FileZilla is started. No information will be submitted to the website (regardless of FileZilla version).
-En cas de doute , utilisez la seconde option.
+If in doubt, use the second option.
-Si vous ne souhaitez pas autoriser les connexions entrantes sur tous les ports , ou si vous avez un routeur NAT , vous devez dire à FileZilla d'utiliser une gamme spécifique de ports pour les connexions en mode actif . Vous aurez à ouvrir ces ports dans votre pare-feu . Si vous avez un routeur NAT , vous avez besoin de transmettre ces ports sur la machine locale FileZilla est installé. Selon le modèle de votre routeur , vous pouvez présenter une plage de ports ou vous avez besoin de transmettre tous les ports individuellement.
+If you do not want to allow incoming connections on all ports, or if you have a NAT router, you need to tell FileZilla to use a specific range of ports for active mode connections. You will have to open these ports in your firewall. If you have a NAT router, you need to forward these ports to the local machine FileZilla is installed on. Depending on your router model, you can either forward a range of ports or you need to forward all ports individually.
-ports valides peuvent être de 1 65535 à ; cependant, les ports inférieurs à 1024 sont réservés pour d'autres protocoles . Il est préférable de choisir des ports supérieur ou égal à 50000 pour le mode FTP actif . En raison de la nature de [ http://en.wikipedia.org/wiki/Transmission_Control_Protocol TCP ] ( le protocole de transport ) , un port ne peut être réutilisé immédiatement après chaque connexion . Par conséquent , le nombre de ports ne devrait pas être trop petite pour prévenir l'échec des transferts de multiples petits fichiers . Une gamme de 50 ports devrait être suffisant dans la plupart des cas .
+Valid ports can be from 1 to 65535; however, ports less than 1024 are reserved for other protocols. It is best to choose ports greater than or equal to 50000 for active mode FTP. Due to the nature of [http://en.wikipedia.org/wiki/Transmission_Control_Protocol TCP] (the underlying transport protocol), a port cannot be reused immediately after each connection. Therefore, the range of ports should not be too small to prevent the failure of transfers of multiple small files. A range of 50 ports should be sufficient in most cases.
 <div align="center">
-[ [Image : Settings_activemode.png | Capture d'écran de dialogue de configuration de FileZilla 3 sur la page de configuration pour le mode actif. ] ]
+[[Image:Settings_activemode.png|Screenshot of settings dialog of FileZilla 3 showing configuration page for active mode.]]
-</ Div>
+</div>
-== Mise en place et les tests FileZilla Server ==
+== Setting up and testing FileZilla Server ==
-Configurer le serveur est très similaire à la mise en place du client , avec la différence principale étant que les rôles du mode actif et passif sont inversés .
+{{Warning|The content of this section is '''outdated''' and '''needs to be adapted to apply''' to FileZilla Server version '''''1.x'''''}}
-Une erreur commune , en particulier par les utilisateurs avec des routeurs NAT , est en test sur le serveur. Si vous êtes dans votre réseau local , vous ne pouvez tester en utilisant l'adresse IP locale du serveur . En utilisant l'adresse externe de l'intérieur va probablement échouer , et l'un des suivants peut se produire :
+Setting up the server is very similar to setting up the client, with the main difference being that the roles of active and passive mode are reversed.
-* Il fonctionne ( étonnant - et c'est probablement quelque chose qui ne va pas ... )
-* L'accès routeur bloque à sa propre adresse externe de l'intérieur , en raison de l'identification comme une éventuelle attaque
-* Le routeur transfère la connexion à votre FAI , qui l'a ensuite blocs comme une éventuelle attaque
-Même si le test fonctionne , il n'ya aucune garantie que les utilisateurs externes peuvent réellement se connecter à votre serveur et de transférer des fichiers . Le seul moyen fiable de tester votre serveur est d'essayer de connecter un système externe '','' en dehors de votre réseau local.
-=== === mode actif
+A common mistake, especially by users with NAT routers, is in testing the server. If you are within your local network, you can only test using the local IP address of the server. Using the external address from the inside will probably fail, and one of the following may happen:
+* It actually works (surprisingly - and it probably means something else is wrong ...)
+* The router blocks access to its own external address from the inside, due to identifying it as a possible attack
+* The router forwards the connection to your ISP, which then blocks it as a possible attack
+Even if the test works, there is no guarantee that an external user can really connect to your server and transfer files. The only reliable way to test your server is to try connecting from an external system, ''outside'' of your LAN.
-Assurez-vous que FileZilla Server est autorisée à établir des connexions sortantes vers les ports arbitraire, puisque le client contrôle le port à utiliser .
+=== Active mode ===
-Sur l'extrémité locale de la connexion, FileZilla Server essaie d'utiliser un port un de moins que celui de la connexion de contrôle (par exemple le port 20 si le serveur est à l'écoute sur le port 21) . Toutefois , ce n'est pas toujours possible - il ne faut pas compter sur elle .
+Make sure FileZilla Server is allowed to establish outgoing connections to arbitrary ports, since the client controls which port to use.
-=== === mode passif
+On the local end of the connection, FileZilla Server tries to use a port one less than that of the control connection (e.g. port 20 if server is listening on port 21). However, this is not always possible - so don't rely on it.
-La configuration du serveur est très semblable à la configuration du client pour le mode actif. En mode passif , le serveur ouvre un socket et attend le client pour se connecter à lui .
+=== Passive mode ===
-Par défaut , FileZilla Server demande au système d'exploitation pour l'adresse IP de la machine , et pour un numéro de port libre . Cette configuration ne peut fonctionner que si vous êtes connecté directement à Internet sans routeur NAT et si vous avez configuré votre pare-feu pour autoriser les connexions entrantes sur tous les ports supérieurs à 1024 .
+The server configuration is very similar to client configuration for active mode. In passive mode, the server opens a socket and waits for the client to connect to it.
-Si vous avez un routeur NAT , vous devez dire à FileZilla Server votre adresse IP externe ou connexions en mode passif ne fonctionne pas avec les clients en dehors de votre réseau local :
+By default, FileZilla Server asks the operating system for the machine's IP address, and for a free port number. This configuration can only work if you are connected to the internet directly without any NAT router and if you have set your firewall to allow incoming connections on all ports greater than 1024.
-* Si vous avez une adresse IP externe fixe , vous pouvez l'indiquer dans la boîte de dialogue de configuration de FileZilla Server .
-* Si vous avez une adresse IP dynamique , vous pouvez laisser FileZilla Server obtenir votre adresse IP externe à partir d'un site web spécial automatiquement. Sauf votre version de FileZilla Server , aucune information ne sera soumis à ce site.
-En cas de doute , utilisez la seconde option.
-Si vous ne souhaitez pas autoriser les connexions entrantes sur tous les ports , ou si vous avez un routeur NAT , vous devez dire à FileZilla Server pour utiliser une plage spécifique de ports pour les connexions en mode passif . Vous aurez à ouvrir ces ports dans votre pare-feu . Si vous avez un routeur NAT , vous avez besoin de transmettre ces ports à la machine locale FileZilla Server est installé. Selon le modèle de votre routeur , vous pouvez présenter une plage de ports ou vous avez besoin de transmettre tous les ports individuellement.
+If you have a NAT router, you need to tell FileZilla Server your external IP address or passive mode connections will not work with clients outside your local network:
+* If you have a fixed external IP address, you can enter it in the configuration dialog of FileZilla Server.
+* If you have a dynamic IP address, you can let FileZilla Server obtain your external IP address from a special website automatically. Except your version of FileZilla Server, no information will be submitted to that website.
+If in doubt, use the second option.
-ports valides peuvent être de 1 à 65535, toutefois les ports inférieurs à 1024 sont réservés pour d'autres protocoles . Il est préférable de choisir des ports > = 50000 pour le mode FTP passif . En raison de la nature de [ http://en.wikipedia.org/wiki/Transmission_Control_Protocol TCP ] ( le protocole de transport ) , un port ne peut être réutilisé immédiatement après chaque connexion . D'où la plage de ports ne devrait pas être trop petite ou les transferts de multiples petits fichiers peuvent échouer. Une gamme de 50 ports devrait être suffisant dans la plupart des cas .
+If you do not want to allow incoming connections on all ports, or if you have a NAT router, you need to tell FileZilla Server to use a specific range of ports for passive mode connections. You will have to open these ports in your firewall. If you have a NAT router, you need to forward these ports to the local machine FileZilla Server is installed on. Depending on your router model, you can either forward a range of ports or you need to forward all ports individually.
+Valid ports can be from 1 to 65535, however ports less than 1024 are reserved for other protocols. It is best to choose ports >= 50000 for passive mode FTP. Due to the nature of [http://en.wikipedia.org/wiki/Transmission_Control_Protocol TCP] (the underlying transport protocol), a port cannot be reused immediately after each connection. Hence the range of ports should not be too small or transfers of multiple small files can fail. A range of 50 ports should be sufficient in most cases.
 <div align="center">
-[ [Image : Serversettings_passive.png | Capture d'écran de dialogue de configuration de FileZilla Server montrant la page de configuration pour le mode passif . ] ]
+[[Image:Settings_passivemode_FZServer.png||Screenshot of settings dialog of FileZilla Server showing configuration page for passive mode.]]
-</ Div>
+</div>
-Dépannage == ==
+== Troubleshooting ==
-Les éléments suivants sont des suggestions de dépannage quelques-uns:
+The following are a few troubleshooting suggestions:
-Malheureusement, de nombreux pare-feu personnels et des routeurs grand public sont défectueux ou, dans certains cas, même activement sabotage FTP (par exemple [ http://www.gbnetwork.co.uk/smcftpd/ SMC Barricade V1.2 ] ) . Tout d'abord , comme avec tous les logiciels , vous devez conserver tout à jour . Cela inclut le logiciel pare-feu ainsi que la version du firmware de votre routeur .
+Unfortunately, many personal firewalls and consumer routers are flawed or in some cases, even actively sabotage FTP (e.g. [http://www.gbnetwork.co.uk/smcftpd/ SMC Barricade V1.2]). First of all, as with all software, you should keep everything updated. This includes the firewall software as well as the firmware version of your router.
-Si cela ne vous aide pas, vous pourriez vouloir essayer de ''' désinstaller ''' votre pare-feu pour voir ce qui se passe . Il suffit de désactiver votre pare-feu pourrait ne pas fonctionner , comme certains pare-feu ne peut être entièrement désactivé .
+If that does not help, you might want to try to '''uninstall''' your firewall to see what happens. Simply disabling your firewall might not work, as some firewalls cannot be fully disabled. In particular, most firewalls install virtual device drivers which cannot be disabled other than by uninstalling them. Also check for hidden firewalls. Programs such as virus scanners often have firewall functionality as well.
-Si possible, essayez de vous connecter directement à Internet sans routeur .
+If possible, try to connect directly to the internet without a router by plugging your computer directly into your modem. If you have a combination modem/router device, try putting it into bridge mode to disable the routing part.
-Si vous essayez de configurer un serveur et cela fonctionne bien au sein de votre réseau local , mais n'est pas accessible de l'extérieur , essayez de changer le port d'écoute . Certains FAI ne sont pas comme leurs clients vers les serveurs hôtes et ils peuvent bloquer les ports avec des nombres inférieurs à 1024 .
+If you are trying to setup a server and it works fine within your LAN but is not reachable from the outside, try changing the listening port. Some ISPs don't like their customers to host servers and they may block ports with numbers under 1024.
-Un autre problème peut se produire si vous hébergez un serveur FTP sur le port 21 par défaut . Il pourrait y avoir un pare-feu sur le côté FAI de votre connexion qui peut faire des choses bizarres comme changer le port pour les commandes PASV . Essayez d'utiliser un autre port que celui par défaut de votre serveur FTP .
+Another issue may occur if you are hosting an FTP server on default port 21. There might be a firewall at the ISP side of your connection which can do odd things like changing the port for PASV commands. Try using another non-default port for your FTP server.
-Si vous rencontrez "ne peut pas ouvrir la connexion de données " sur une base aléatoire (par exemple , le client FTP peut se connecter au serveur FTP sans problème pour de nombreuses connexions jusqu'à ce qu'il rencontre ce problème ) , une raison possible peut être que votre PC client logiciel anti-virus est configuré pour bloquer les connexions sortantes sur certaines gammes de ports . Lorsque votre connexion FTP sont en cours d'exécution en mode PASV , les ports côté client sortants sont sélectionnés au hasard et certains de ceux choisis au hasard ports peuvent être bloqués par le logiciel anti -virus . Pour identifier ce problème , lisez votre journal anti -virus sur le client . En général , tout logiciel qui peut bloquer certaines gammes de ports de sortie ( tels que pare-feu PC ) peut provoquer des douleurs semblables FTP .
+If you encounter "cannot open data connection" on a random basis (i.e., the ftp client can connect to the ftp server without problem for many connections until it encounters this problem), one possible reason may be that your client PC anti-virus software is configured to block outgoing connections on certain ranges of ports. When your ftp connections are running in pasv mode, the client-side outgoing ports are selected randomly and some of those randomly selected ports may be blocked by the anti-virus software. To identify this problem, read your anti-virus log on the client. In general, any software that can block certain ranges of outgoing ports (such as PC firewalls) can cause similar FTP grief.
-Délais d'attente === === sur de gros fichiers
+=== Timeouts on large files ===
-Si vous pouvez transférer des fichiers de petite taille sans aucun problème , mais les transferts de fichiers de plus fin avec un délai d'attente , un routeur brisées et / ou pare-feu existe entre le client et le serveur et est à l'origine d'un problème .
+If you can transfer small files without any issues, but transfers of larger files end with a timeout, a broken router and/or firewall exists between the client and the server and is causing a problem.
-Comme mentionné plus haut , FTP utilise deux connexions TCP : Une connexion de contrôle de présenter les commandes et recevoir des réponses , et une connexion de données pour les transferts de fichier réel . C'est la nature de FTP que lors d'un transfert de la connexion de contrôle reste totalement inactif.
+As mentioned above, FTP uses two TCP connections: a control connection to submit commands and receive replies, and a data connection for actual file transfers. It is the nature of FTP that during a transfer the control connection stays completely idle.
-Les spécifications TCP ne fixent pas de limite sur la quantité de temps d'une connexion peut rester inactif. Sauf explicitement fermée , une connexion est supposé rester en vie indéfiniment . Cependant , beaucoup de routeurs et pare-feu se ferment automatiquement les connexions inactives après une certaine période de temps . Pire encore, ils omettent souvent de prévenir l'utilisateur, mais silencieusement déroulant la connexion. Pour FTP , cela signifie que, pendant un long transfert de la connexion de contrôle pourraient tomber , car il est détecté comme inactif , mais ni le client ni le serveur sont notifiés. Ainsi, lorsque toutes les données ont été transférées , le serveur suppose la connexion de contrôle est vivant et il envoie la réponse de confirmation de transfert . De même , le client pense que la connexion de contrôle est vivant et il attend la réponse du serveur. Mais depuis la connexion de contrôle s'est passé sans notification , la réponse n'arrive jamais et, éventuellement, la connexion sera arrêtée .
+The TCP specifications do not set a limit on the amount of time a connection can stay idle. Unless explicitly closed, a connection is assumed to remain alive indefinitely. However, many routers and firewalls automatically close idle connections after a certain period of time. Worse, they often don't notify the user, but just silently drop the connection. For FTP, this means that during a long transfer the control connection can get dropped because it is detected as idle, but neither client nor server are notified. So when all data has been transferred, the server assumes the control connection is alive and it sends the transfer confirmation reply. Likewise, the client thinks the control connection is alive and it waits for the reply from the server. But since the control connection got dropped without notification, the reply never arrives and eventually the connection will timeout.
-Pour tenter de résoudre ce problème , les spécifications TCP comprennent un moyen d'envoyer des paquets '' keep-alive '' sur les connexions TCP contraire ralenti , de dire à toutes les parties concernées que la connexion est toujours vivant et nécessaire . Cependant, les spécifications TCP aussi dire très clairement que ces paquets keep-alive ne doit pas être envoyé plus d'une fois toutes les deux heures . Par conséquent , avec une tolérance supplémentaire pour la latence du réseau , des connexions peuvent rester inactif pendant 2 heures et 4 minutes.
+In an attempt to solve this problem, the TCP specifications include a way to send ''keep-alive packets'' on otherwise idle TCP connections, to tell all involved parties that the connection is still alive and needed. However, the TCP specifications also make it very clear that these keep-alive packets should not be sent more often than once every two hours. Therefore, with added tolerance for network latency, connections can stay idle for up to 2 hours and 4 minutes.
-Cependant , beaucoup de routeurs et pare-feu des connexions déroulant qui ont été inactif pendant moins de 2 heures et 4 minutes. Ceci viole les spécifications TCP ( [ RFC 5382 http://filezilla-project.org/specs/rfc5382.txt ] rend ce particulièrement clair ) . En d'autres termes , tous les routeurs et les pare-feux qui sont à la baisse les connexions inactives trop tôt ne peut pas être utilisé pour les transferts FTP de long. Malheureusement les fabricants de routeur de consommation de qualité et les vendeurs de pare-feu ne se soucient pas des spécifications ... tout ce qu'ils demandent est de récupérer votre argent (et seulement offrir peine de travail junk qualité la plus basse ) .
+However, many routers and firewalls drop connections that have been idle for less than 2 hours and 4 minutes. This violates the TCP specifications ([http://filezilla-project.org/specs/rfc5382.txt RFC 5382] makes this especially clear). In other words, all routers and firewalls that are dropping idle connections too early cannot be used for long FTP transfers. Unfortunately manufacturers of consumer-grade router and firewall vendors do not care about specifications ... all they care about is getting your money (and only deliver barely working lowest quality junk).
-Pour résoudre ce problème , vous devez désinstaller et de remplacer les pare-feu touchés routeurs défectueux par ceux de meilleure qualité .
+To solve this problem, you need to uninstall affected firewalls and replace faulty routers with better-quality ones.
-== Configuration FileZilla Server Pare-feu Windows ==
+== Setting up FileZilla Server with Windows Firewall ==
-Si vous rencontrez des problèmes avec la mise en place FileZilla Server de courir derrière Pare-feu Windows (en particulier , il échoue sur "Liste" et le client reçoit un "Impossible de recevoir inscription à l'annuaire " d'erreur ) , vous devez ajouter l'application FileZilla Server pour Exceptions Windows Firewall la liste . Pour ce faire, procédez comme suit :
+If you are having problems with setting up FileZilla Server to run behind Windows Firewall (specifically, it fails on "List" and the client receives a "Failed to receive directory listing" error), you must add the FileZilla Server application to Windows Firewall's Exceptions list.  To do this, follow these steps:
-# Ouvrez Pare-feu Windows dans le Panneau de configuration .
+# Open Windows Firewall under Control Panel.
-# Si vous utilisez Vista , cliquez sur " Modifier les paramètres "
+# If using Vista, click "Change Settings"
-# Sélectionnez l' onglet "Exceptions" .
+# Select the "Exceptions" tab.
-# Cliquez sur " Ajouter un programme ... "
+# Click "Add program..."
-# Ne sélectionnez pas " FileZilla Server Interface "de la liste , au lieu de cliquer sur "Parcourir ..."
+# Do NOT select "FileZilla Server Interface" from the list, instead click on "Browse..."
-# Recherchez le répertoire que vous avez installé FileZilla Server ( normalement " C : \ Program Files \ FileZilla Server \ " )
+# Locate the directory you installed FileZilla Server to (normally "C:\Program Files\FileZilla Server\")
-# Double-cliquez ou sélectionnez « FileZilla server.exe " et appuyez sur Ouvrir (Encore une fois , pas " FileZilla Server Interface.exe " )
+# Double click or select "FileZilla server.exe" and press open (Once again, NOT "FileZilla Server Interface.exe")
-# Sélectionnez " server.exe FileZilla " dans la liste et cliquez sur "Ok"
+# Select "FileZilla server.exe" from the list and click "Ok"
-# Vérifiez que " server.exe FileZilla "est ajouté à la liste des exceptions et qu'il a une coche dans la case à côté de lui
+# Verify that "FileZilla server.exe" is added to the exceptions list and that it has a check mark in the box next to it
-# Appuyez sur "OK " pour fermer la fenêtre
+# Press "Ok" to close the window
+# Open a command prompt with administrative rights and execute the following command: ''netsh advfirewall set global statefulftp disable''
-Le mode passif devrait maintenant fonctionner . Si vous rencontrez toujours des problèmes de connexion ( depuis un autre ordinateur ou à l'extérieur du réseau ) , vérifiez les paramètres de votre routeur ou essayez d'ajouter le numéro de port dans les paramètres de [ [ Windows ] Firewall ] situé dans l'onglet Exceptions .
+Passive mode should now work.  If you are still having problems connecting (from another computer or outside the network), check your router settings or try to add the port number in the [[Windows]] Firewall settings located in the Exceptions tab.
-Voir l'article KB 931130 de Microsoft sur l'exécution de FileZilla avec le " Routage et accès distant »ou« Application Layer Gateway " service activé.
+See the Microsoft kb article 931130 about running FileZilla with the "Routing and Remote Access" or the "Application Layer Gateway" service enabled.
 http://support.microsoft.com/kb/931130
+== Setting up FileZilla Server with Windows 8 Firewall ==
+These are the instructions if your operating system is Windows 8 - the interface is slightly different from that described above in [[Network Configuration#Setting up FileZilla Server with Windows Firewall|Setting up FileZilla Server with Windows Firewall]].
+Under Windows 8 you must allow the FileZilla Server application through Windows Firewall. To do this, follow these steps:
+# Move mouse to upper right corner and click the magnifying glass search icon, and type "firewall" (without the double quotes) in the Search box and then click the "Settings" text. Or, hold down the Windows logo key on the keyboard and press the I key, select the text "Control Panel" and press Enter, in the Search Control Panel area at top right type "firewall". In either case, now click the "Allow an app through Windows Firewall" that should appear.
+# Click "Change Settings" and a new button should appear titled "Allow another app..."
+# Click "Allow another app..."
+# A window titled "Add an app" should appear; do not do anything in this step.
+# Do NOT select "FileZilla Server Interface" from the list, instead click on "Browse..."
+# Locate the directory you installed FileZilla Server to (normally "C:\Program Files\FileZilla Server\")
+# Double click or select "FileZilla server.exe" and press open (Once again, NOT "FileZilla Server Interface.exe")
+# Your mouse pointer should now return to the "Add an app" window; scroll down the list and select "FileZilla server.exe" and click "Add".
+# Your mouse pointer should now return to the Windows Firewall Allowed apps window; verify that "FileZilla server.exe" is added to the allowed apps and features list and that it has a check mark in either the Private box or the Public box. Choose Private if you want the server accessible only from within your local network, and choose Public if you want the server accessible from outside your local network (this might include clients connected wirelessly to your network).
+# Press "Ok" to close the Windows Firewall window
+# Open a command prompt with administrative rights and execute the following command: ''netsh advfirewall set global statefulftp disable''
+If you are still having problems see the advice at the end of section [[Network Configuration#Setting up FileZilla Server with Windows Firewall|Setting up FileZilla Server with Windows Firewall]] above or search Microsoft Knowledge base for Firewall related articles.