Network Configuration: Difference between revisions

From FileZilla Wiki
Jump to navigationJump to search
m (→‎Setting up FileZilla Client: 123.123.123.123 on port 24*256+55 = 6199)
 
(223 intermediate revisions by more than 100 users not shown)
Line 1: Line 1:
Setting up network components for FTP is not trivial for use outside your LAN (Local Area Network). Since so many firewalls and routers  exist, it is impractical to give detailed step-by-step instructions suitable for every user. It is important to understand the basics of the FTP protocol in order to configure FileZilla and the routers and/or firewalls involved.
Setting up network components for FTP is not trivial for use outside your LAN (Local Area Network). Since so many firewalls and routers  exist, it is impractical to give detailed step-by-step instructions suitable for every user. It is important to understand the basics of the FTP protocol in order to configure FileZilla and the routers and/or firewalls involved.
This documentation describes the history of the FTP protocol and how some aspects of the protocol work. Reading it carefully will save you a lot of trouble setting up FTP.
This documentation describes the history of the FTP and how some aspects of the protocol work. Reading it carefully will save you a lot of trouble setting up FTP.


== Background ==
== Background ==


Bagian ini memberikan gambaran tentang latar belakang historis dan teknis dari protokol FTP. Untuk rinci dalam informasi mendalam lihat [[File Transfer Protocol | spesifikasi]].
This section provides an overview of the historical and technical background of the FTP protocol. For detailed in-depth information see [[File Transfer Protocol|specifications]].


Latar Belakang Sejarah === ===
=== Historical Background ===


Dalam dunia yang hidup cepat internet, File Transfer Protocol tidak hanya tua, itu kuno. Draft awal protokol kembali sejauh 1971, dan spesifikasi saat ini dari tahun 1985. Protokol bahkan mungkin lebih tua dari Anda!
In the fast living world of the internet, the File Transfer Protocol is not just old, it's ancient. Early drafts of the protocol go back as far as 1971, and the current specifications are from 1985. The protocol might even be older than you!


Kembali kemudian, internet terutama digunakan oleh universitas-universitas dan pusat penelitian. Masyarakat itu kecil, banyak pengguna saling kenal dan semuanya berkolaborasi bersama. Internet adalah tempat yang ramah dan percaya. Keamanan tidak banyak perhatian.
Back then, the Internet was mainly used by universities and research centers. The community was small, many users knew each other and all were collaborating together. The internet was a friendly, trusting place. Security was not much of a concern.


Banyak yang telah berubah sejak saat itu. Internet sekarang di mana-mana, dengan jutaan pengguna berkomunikasi dengan satu sama lain dalam berbagai cara.
A lot has changed since then. The Internet is now ubiquitous, with millions of users communicating with each other in many different ways.
Ini juga merupakan tempat yang lebih bermusuhan. Ketersediaan dan keterbukaan telah menarik pengguna yang jahat yang mengeksploitasi keterbatasan desain, implementasi lengkap, bug, dan pengalaman dari pengguna lain. Sebuah perangkat lunak terkenal perusahaan yang berlokasi di Redmond, WA tentu memainkan bagian dalam.
It is also a more hostile place. The availability and openness has attracted malicious users who exploit design limitations, incomplete implementations, bugs, and the inexperience of other users.  


Beberapa upaya telah dilakukan untuk mengatasi masalah ini:
Several attempts have been made to address these problems:
* [Http://en.wikipedia.org/wiki/Network_address_translation NAT] (Network Address Translation) router. Banyak host dan router di internet menggunakan [http://en.wikipedia.org/wiki/IPv4 IPv4] protokol. Jumlah host yang terhubung ke internet telah mencapai batas desain IPv4 untuk jumlah alamat ([http://en.wikipedia.org/wiki/IPv6 IPv6] dirancang untuk meringankan ini). NAT router memungkinkan beberapa sistem dalam LAN untuk menghubungkan ke dunia luar dengan satu alamat IP eksternal.
* [http://en.wikipedia.org/wiki/Network_address_translation NAT] (Network Address Translation) routers. Many hosts and routers on the internet use the [http://en.wikipedia.org/wiki/IPv4 IPv4] protocol. The number of hosts connected to the internet has reached IPV4's design limit for the number of addresses ([http://en.wikipedia.org/wiki/IPv6 IPv6] is designed to relieve this). NAT routers allow multiple systems within a LAN to connect to the outside world with one external IP address.
* [Http://en.wikipedia.org/wiki/Personal_firewall Personal firewall] mencoba untuk melindungi komputer pribadi dari serangan oleh pengguna yang jahat.
* [http://en.wikipedia.org/wiki/Personal_firewall Personal firewalls] try to protect personal computers from attacks by malicious users.


Sayangnya, baik NAT dan firewall pribadi konflik dengan FTP lebih sering daripada tidak. Untuk membuat hal-hal buruk, beberapa cacat diri mereka sendiri, menyebabkan masalah tambahan mengenai FTP.
Unfortunately, both NAT and personal firewalls conflict with FTP more often than not. To make things worse, some are themselves flawed, causing additional problems regarding FTP.


=== Teknis === latar belakang
=== Technical background ===


Apa yang membedakan FTP dari protokol lain kebanyakan adalah penggunaan koneksi sekunder untuk transfer file. Bila Anda terhubung ke server FTP, Anda benar-benar membuat dua koneksi. Pertama, koneksi''disebut''kontrol didirikan, di mana FTP perintah dan balasan mereka ditransfer. Kemudian, dalam rangka untuk mentransfer file atau daftar direktori, client mengirimkan perintah tertentu melalui koneksi kontrol untuk mendirikan''''koneksi data.
What distinguishes FTP from most other protocols is the use of secondary connections for file transfers. When you connect to an FTP server, you are actually making two connections. First, the so-called ''control connection'' is established, over which FTP commands and their replies are transferred. Then, in order to transfer a file or a directory listing, the client sends a particular command over the control connection to establish the ''data connection''.


Sambungan data dapat dibentuk dua cara yang berbeda, menggunakan modus aktif''''atau''''modus pasif.
The data connection can be established two different ways, using ''active mode'' or ''passive mode''.


Dalam mode pasif, yang direkomendasikan (lihat di bawah), client mengirimkan perintah PASV ke server, dan server merespon dengan alamat. Klien kemudian mengeluarkan perintah untuk mentransfer file atau untuk mendapatkan daftar direktori, dan membentuk sambungan sekunder ke alamat dikembalikan oleh server.
In passive mode, which is recommended (see below), the client sends the PASV command to the server, and the server responds with an address. The client then issues a command to transfer a file or to get a directory listing, and establishes a secondary connection to the address returned by the server.


Dalam mode aktif, klien membuka soket pada mesin lokal dan memberitahu alamat ke server menggunakan perintah PORT. Setelah klien mengeluarkan perintah untuk mentransfer file atau daftar, server akan terhubung ke alamat yang diberikan oleh klien.
In active mode, the client opens a socket on the local machine and tells its address to the server using the PORT command. Once the client issues a command to transfer a file or listing, the server will connect to the address provided by the client.


Dalam kedua kasus, file yang sebenarnya atau daftar ini kemudian ditransfer melalui koneksi data.
In both cases, the actual file or listing is then transferred over the data connection.


Umumnya, membangun koneksi keluar memerlukan kurang konfigurasi pada router / firewall terlibat daripada membangun koneksi masuk. Dalam mode pasif, sambungan keluar pada sisi client dan masuk pada sisi server dan dalam mode aktif ini terbalik.
Generally, establishing outgoing connections requires less configuration on the routers/firewalls involved than establishing incoming connections. In passive mode, the connection is outgoing on the client side and incoming on the server side and in active mode this is reversed.
Perhatikan bahwa perbedaan hanya dalam membangun koneksi. Setelah didirikan, koneksi dapat digunakan untuk upload atau download.
Note that the only differences are in establishing a connection. Once established, the connection can be used for uploads or downloads.


Pengaturan jaringan yang umum mungkin terlihat seperti ini:
A common network setup might look like this:


[[Gambar: FTP1.png | center]]
[[Image:FTP1.png|center]]




Dalam mode pasif, router dan firewall di sisi server harus dikonfigurasi untuk menerima koneksi masuk dan maju. Di sisi klien, bagaimanapun, hanya koneksi keluar harus diperbolehkan (yang sudah akan terjadi sebagian besar waktu).
In passive mode, the router and firewall on the server side need to be configured to accept and forward incoming connections. On the client side, however, only outgoing connections need to be allowed (which will already be the case most of the time).


Analog, dalam modus aktif, router dan firewall di sisi klien harus dikonfigurasi untuk menerima koneksi masuk dan maju. Hanya koneksi keluar harus diperbolehkan pada sisi server.
Analogously, in active mode, the router and firewall on the client side need to be configured to accept and forward incoming connections. Only outgoing connections have to be allowed on the server side.


Karena dalam kebanyakan kasus satu server menyediakan layanan bagi banyak pengguna, lebih mudah untuk mengkonfigurasi router dan firewall di sisi server sekali untuk mode pasif daripada mengkonfigurasi router klien / firewall untuk setiap klien individu dalam modus aktif. Oleh karena itu, modus pasif direkomendasikan dalam banyak kasus.
Since in most cases one server provides a service for many users, it is much easier to configure the router and firewall on the server side once for passive mode than to configure the client's router/firewall for each individual client in active mode. Therefore, passive mode is recommended in most cases.


NAT router ==== ====
==== NAT routers ====


Sebagian besar pengguna broadband akan memiliki NAT (Network Address Translation) router antara komputer mereka dan internet. Ini mungkin merupakan sebuah perangkat router mandiri (mungkin router nirkabel), atau dibangun ke modem DSL atau kabel. Dalam lingkungan NAT, semua sistem di belakang router NAT bentuk''Jaringan Area Lokal (LAN)'', dan setiap sistem di LAN memiliki alamat IP lokal (dikenali sebagai empat angka yang dipisahkan oleh titik kecil). Router NAT itu sendiri memiliki alamat IP lokal juga. Selain itu, router NAT juga memiliki alamat IP eksternal dengan yang diketahui ke Internet.
Most broadband users will have a NAT (Network Address Translation) router between their computer and the internet. This may be a standalone router device (perhaps a wireless router), or be built into a DSL or cable modem. In a NAT environment, all systems behind the NAT router form a ''Local Area Network (LAN)'', and each system in the LAN has a local IP address (recognizable as four small numbers separated by dots. See [http://en.wikipedia.org/wiki/Private_network Private addresses]). The NAT router itself has a local IP address as well. In addition, the NAT router also has an external IP address by which it is known to the Internet.


Sebuah sistem contoh mungkin terlihat seperti ini:
An example system might look like this:




[[Gambar: FTP2.png | center]]
[[Image:FTP2.png|center]]




Alamat IP internal hanya berlaku di dalam LAN, karena mereka akan masuk akal sedikit ke sistem remote. Pikirkan tentang sebuah server di belakang router NAT. Bayangkan apa yang mungkin terjadi jika klien permintaan mode pasif, tetapi server tidak tahu alamat IP eksternal dari router NAT. Jika server mengirimkan alamat internal untuk klien, dua hal bisa terjadi:
The internal IP addresses are only valid inside the LAN, since they would make little sense to a remote system. Think about a server behind a NAT router. Imagine what might happen if a client requests passive mode, but the server doesn't know the external IP address of the NAT router. If the server sends its internal address to the client, two things could happen:
* Jika klien tidak di belakang NAT, klien akan membatalkan karena alamat tidak valid.
* If the client is not behind a NAT, the client would abort since the address is invalid.
* Jika klien berada di belakang NAT, alamat yang diberikan oleh server mungkin sama sebagai sebuah sistem di LAN klien sendiri.
* If the client is behind a NAT, the address given by the server might be the same as a system in the client's own LAN.
Jelas, dalam kedua kasus mode pasif akan mustahil.
Obviously, in both cases passive mode would be impossible.


Jadi jika server berada di belakang router NAT, perlu mengetahui alamat IP eksternal dari router dalam mode pasif. Dalam hal ini, server akan mengirimkan alamat eksternal router ke klien. Klien kemudian menetapkan koneksi ke router NAT, yang pada gilirannya rute koneksi ke server.
So if a server is behind a NAT router, it needs to know the external IP address of the router in passive mode. In this case, the server sends the router's external address to the client. The client then establishes a connection to the NAT router, which in turn routes the connection to the server.


=== === Firewall
=== Firewalls ===


''''Personal firewall yang diinstal pada banyak sistem untuk melindungi pengguna dari kerentanan keamanan di sistem operasi atau aplikasi yang berjalan di atasnya. Melalui internet, malware seperti cacing mencoba untuk mengeksploitasi kelemahan untuk menginfeksi sistem Anda. Firewall dapat membantu untuk mencegah infeksi. Namun, firewall dan aplikasi keamanan lainnya kadang dapat mengganggu non-berbahaya transfer file.
''Personal firewalls'' are installed on many systems to protect users from security vulnerabilities in the operating system or applications running on it. Over the internet, malware such as worms try to exploit these flaws to infect your system. Firewalls can help to prevent such an infection. However, firewalls and other security applications can sometimes interfere with non-malicious file transfers.


Terutama jika menggunakan FTP, pengguna firewall kadang-kadang mungkin melihat pesan seperti ini dari firewall mereka:
Especially if using FTP, firewall users might occasionally see messages like this from their firewall:
  Trojan Netbus diblokir pada port 12345 yang digunakan oleh FileZilla.exe
  Trojan Netbus blocked on port 12345 used by FileZilla.exe


Dalam banyak kasus, ini adalah alarm palsu. Setiap program dapat memilih port yang diinginkannya untuk komunikasi melalui internet. Filezilla, kemudian, dapat memilih port yang kebetulan juga port default dari sebuah trojan atau malware lainnya sedang dilacak oleh firewall Anda. FileZilla adalah bersih dari malware''asalkan di-download dari situs resmi''.
In many cases, this is a false alarm. Any program can choose any port it wants for communication over the internet. FileZilla, then, might choose a port that is coincidentally also the default port of a trojan or some other malware being tracked by your firewall. FileZilla is clean of malware ''as long as it is downloaded from the official website''.


=== Berbahaya router, firewall dan sabotase Data ===
=== Malicious routers, firewalls and data sabotage ===


Beberapa router dan firewall berpura-pura pintar. Mereka menganalisis koneksi dan, jika mereka berpikir mereka mendeteksi FTP, mereka diam-diam mengubah data dipertukarkan antara klien dan server. Jika pengguna tidak secara eksplisit mengaktifkan fitur ini, perilaku ini pada dasarnya adalah data yang sabotase dan dapat menyebabkan berbagai masalah.
Some routers and firewalls pretend to be smart. They analyze connections and, if they think they detect FTP, they silently change the data exchanged between client and server. If the user has not explicitly enabled this feature, this behavior is essentially data sabotage and can cause various problems.


Sebagai contoh, bayangkan sebuah klien di belakang router NAT mencoba untuk menyambung ke server. Mari kita lebih lanjut mengasumsikan bahwa klien ini tidak tahu itu berada di belakang NAT dan ingin menggunakan modus aktif. Jadi mengirimkan perintah PORT dengan alamat lokal pengguna, un-routable IP untuk server:
For an example, imagine a client behind a NAT router trying to connect to the server. Let's further assume that this client does not know it is behind a NAT and wants to use active mode. So it sends the PORT command with the user's local, un-routable IP address to the server:


  PORT 10,0,0,1,12,34
  PORT 10,0,0,1,12,34


Perintah ini memberitahu server untuk menghubungkan ke alamat 10.0.0.1 di port 12 * 34 = 256 3106
This command tells the server to connect to the address 10.0.0.1 on port 12*256+34 = 3106


Router NAT melihat ini dan diam-diam perubahan perintah untuk memasukkan alamat IP eksternal. Pada saat yang sama, router NAT juga akan membuat port forwarding sementara untuk sesi FTP, mungkin pada port yang berbeda bahkan:
The NAT router sees this and silently changes the command to include the external IP address. At the same time, the NAT router will also create a temporary port forwarding for the FTP session, possibly on a different port even:


  PORT 123,123,123,123,24,55
  PORT 123,123,123,123,24,55


Perintah di atas memberitahu server untuk menghubungkan ke alamat 123.123.123.123 pada port 24 * 256 +55 = 6199
The above command tells the server to connect to the address 123.123.123.123 on port 24*256+55 = 6199


Dengan perilaku ini, router NAT memungkinkan klien tidak benar dikonfigurasi untuk menggunakan modus aktif.
With this behavior, a NAT router allows an improperly configured client to use active mode.


Jadi mengapa perilaku ini buruk? Pada dasarnya, hal itu dapat menyebabkan sejumlah masalah jika diaktifkan secara default, tanpa izin pengguna eksplisit. Koneksi FTP dalam bentuk yang paling dasar muncul untuk bekerja, tapi begitu ada beberapa penyimpangan dari kasus dasar, semuanya akan gagal, sehingga pengguna bingung:
So why is this behavior bad? Essentially, it can cause a number of problems if it is enabled by default, without explicit user consent. The FTP connections in their most basic form appear to work, but as soon as there's some deviation from the basic case, everything will fail, leaving the user stumped:


* Router NAT membabi buta mengasumsikan beberapa koneksi menggunakan FTP berdasarkan kriteria seperti port target atau respon server awal:
* The NAT router blindly assumes some connection uses FTP based on criteria like target ports or the initial server response:
** Protokol yang digunakan terdeteksi sebagai FTP, namun tidak ada jaminan bahwa hal ini benar (a''palsu''positif). Meskipun tidak mungkin, dapat dibayangkan bahwa revisi masa depan protokol FTP mungkin mengubah sintaks dari perintah PORT. Sebuah router NAT memodifikasi perintah PORT kemudian akan diam-diam mengubah hal-hal itu tidak mendukung dan dengan demikian merusak sambungan.
** The used protocol is detected as FTP, yet there is no guarantee that this is true (a ''false positive''). Though unlikely, it is conceivable that a future revision of the FTP protocol might change the syntax of the PORT command. A NAT router modifying the PORT command would then silently change things it does not support and thus break the connection.
** Deteksi protokol router dapat gagal untuk mengenali koneksi FTP (sebuah''''negatif palsu). Katakanlah router hanya terlihat di pelabuhan sasaran, dan jika 21, mendeteksi sebagai FTP. Dengan demikian, koneksi modus aktif dengan klien tidak benar dikonfigurasi untuk server yang berjalan pada port 21 akan bekerja, tetapi koneksi ke server lain pada port non-standar akan gagal.
** The router's protocol detection can fail to recognize an FTP connection (a ''false negative''). Say the router only looks at the target port, and if it is 21, it detects it as FTP. As such, active mode connections with an improperly configured client to servers running on port 21 will work, but connections to other servers on non-standard ports will fail.
* Jelas, router NAT tidak bisa lagi mengutak-atik dengan koneksi secepat sesi FTP terenkripsi digunakan, lagi-lagi meninggalkan pengguna clueless mengapa ia bekerja untuk FTP normal tetapi tidak untuk FTP dienkripsi.
* Obviously, a NAT router can no longer tamper with the connection as soon as an encrypted FTP session is used, again leaving the user clueless why it works for normal FTP but not for encrypted FTP.
* Katakanlah klien di belakang router NAT mengirimkan "PORT 10,0,0,1,12,34". Bagaimana router NAT tahu klien dikonfigurasi tidak benar? Hal ini juga kemungkinan bahwa klien dikonfigurasi dengan benar, namun hanya ingin memulai sebuah FXP (server ke server) transfer antara server yang terhubung ke dan mesin lain dalam jaringan lokal sendiri server.
* Say a client behind a NAT router sends "PORT 10,0,0,1,12,34". How does the NAT router know the client is improperly configured? It is also possible that the client is properly configured, yet merely wants to initiate an FXP (server-to-server) transfer between the server it is connected to and another machine in the server's own local network.


Oleh karena itu, memiliki fitur protokol tertentu diaktifkan di router NAT secara default dapat menciptakan masalah yang signifikan. Solusi untuk semua ini, maka, adalah untuk mengetahui pengaturan router Anda, dan untuk mengetahui kemampuan konfigurasi router sebelum Anda memasangnya. Sebuah router NAT yang baik selalu harus sepenuhnya protokol-agnostik. Pengecualian adalah jika Anda sebagai pengguna secara eksplisit telah mengaktifkan fitur ini, yang tahu semua konsekuensinya.
Therefore, having protocol specific features enabled in a NAT router by default can create significant problems. The solution to all this, then, is to know your router's settings, and to know the configuration abilities of a router before you set it up. A good NAT router should always be fully protocol-agnostic. The exception is if you as the user have explicitly enabled this feature, knowing all its consequences.


Meskipun bagian ini hanya membahas kombinasi dari router NAT di sisi klien dengan modus aktif, yang sama berlaku untuk server di belakang router NAT dan jawaban untuk perintah PASV.
While this section only discussed the combination of a NAT router on the client side with active mode, the same applies to a server behind a NAT router and the reply to the PASV command.


Menyiapkan == == Klien filezilla
== Setting up FileZilla Client ==


Jika Anda menjalankan filezilla 3, direkomendasikan Anda menjalankan wizard konfigurasi jaringan. Ini akan memandu Anda melalui langkah-langkah yang diperlukan dan dapat menguji konfigurasi Anda setelah set-up.
If you're running FileZilla 3, it's recommended you run the network configuration wizard. It will guide you through the necessary steps and can test your configuration after set-up.


Jelas, jika Anda ingin terhubung ke server apapun, Anda perlu memberitahu Anda bahwa filezilla firewall seharusnya diizinkan untuk membuka koneksi ke server lain. FTP server menggunakan port yang paling normal 21, SFTP server menggunakan port 22 dan FTP melalui SSL / TLS (modus implisit) menggunakan port 990 secara default. Port ini tidak wajib, bagaimanapun, jadi yang terbaik untuk memungkinkan koneksi keluar ke port jauh sewenang-wenang.
Obviously, if you want to connect to any server, you need to tell your firewall that FileZilla should be allowed to open connections to other servers. Most normal FTP servers use port 21, SFTP servers use port 22 and FTP over TLS (implicit mode) use port 990 by default. These ports are not mandatory, however, so it's best to allow outgoing connections to arbitrary remote ports.


Karena banyak server di internet yang terkonfigurasi dan tidak mendukung kedua modus transfer, itu disarankan agar Anda mengkonfigurasi modus transfer kedua pada akhir Anda.
Since many servers on the internet are misconfigured and don't support both transfer modes, it's recommended that you configure both transfer modes on your end.


=== === Modus pasif
=== Passive mode ===


Dalam mode pasif, klien tidak memiliki kontrol atas apa port server memilih untuk sambungan data. Oleh karena itu, untuk menggunakan mode pasif, Anda harus mengizinkan koneksi keluar ke semua port di firewall Anda.
In passive mode, the client has no control over what port the server chooses for the data connection. Therefore, in order to use passive mode, you'll have to allow outgoing connections to all ports in your firewall.


=== === Modus Aktif
=== Active mode ===


Dalam, modus aktif, Klien Membuka socket server yang murah Menunggu UNTUK membangun koneksi transfer.
In active mode, the client opens a socket and waits for the server to establish the transfer connection.


Secara default, FileZilla Client meminta Operasi SISTEM UNTUK alamat IP mesin murah Jumlah Yang pelabuhan bebas. Konfigurasi ini dapat bekerja jika Hanya terhubung ke internet ANDA secara Langsung Tanpa router NAT, murah jika ANDA Telah mengatur firewall ANDA UNTUK membolehkan koneksi masuk PADA Semua pelabuhan Lebih gede Dari 1024.
By default, FileZilla Client asks the operating system for the machine's IP address and for the number of a free port. This configuration can only work if you are connected to the internet directly without any NAT router, and if you have set your firewall to allow incoming connections on all ports greater than 1024.


Jika ANDA memiliki router NAT, ANDA njaluk alamat IP memberitahu filezilla eksternal ANDA UNTUK Rangka Dalam, modus koneksi aktif UNTUK DENGAN server yang bekerja di Luar Jaringan Lokal Anda:
If you have a NAT router, you need to tell FileZilla your external IP address in order for active mode connections to work with servers outside your local network:
* Jika alamat IP ANDA memiliki Tetap eksternal, ANDA dapat memasukkannya Dalam, dialog Konfigurasi filezilla ITU.
* If you have a fixed external IP address, you can enter it in FileZilla's configuration dialog.
* Jika alamat IP ANDA memiliki Dinamis, ANDA dapat mengotorisasi filezilla mendapatkan alamat IP UNTUK ANDA Dari situs eksternal web Khusus. Akan terjadi ini secara Otomatis setiap kali filezilla dimulai. Tidak ada Informasi Yang Akan disampaikan ke situs web (terlepas Dari versi filezilla).
* If you have a dynamic IP address, you can authorize FileZilla to obtain your external IP address from a special website. This will occur automatically each time FileZilla is started. No information will be submitted to the website (regardless of FileZilla version).
Jika Ragu, gunakan pilihan kedua.
If in doubt, use the second option.


Jika ANDA Tidak Ingin mengizinkan koneksi masuk PADA Semua port, atau jika ANDA memiliki router NAT, ANDA UNTUK njaluk memberitahu filezilla menggunakan Berbagai pelabuhan tertentu UNTUK modus koneksi aktif. ANDA Akan Membuka port yang memiliki UNTUK ANDA Dalam, firewall. Jika ANDA memiliki router NAT, ANDA UNTUK Maju njaluk pelabuhan ini UNTUK JUAL filezilla Lokal diinstal disimpan. Tergantung model router PADA ANDA, ANDA dapat Maju Berbagai pelabuhan atau ANDA UNTUK Maju njaluk Semua port individu.
If you do not want to allow incoming connections on all ports, or if you have a NAT router, you need to tell FileZilla to use a specific range of ports for active mode connections. You will have to open these ports in your firewall. If you have a NAT router, you need to forward these ports to the local machine FileZilla is installed on. Depending on your router model, you can either forward a range of ports or you need to forward all ports individually.
 
Valid ports can be from 1 to 65535; however, ports less than 1024 are reserved for other protocols. It is best to choose ports greater than or equal to 50000 for active mode FTP. Due to the nature of [http://en.wikipedia.org/wiki/Transmission_Control_Protocol TCP] (the underlying transport protocol), a port cannot be reused immediately after each connection. Therefore, the range of ports should not be too small to prevent the failure of transfers of multiple small files. A range of 50 ports should be sufficient in most cases.


Pelabuhan Yang dapat berlaku 1-65535, namun, port Kurang Dari 1024 dicadangkan UNTUK protokol lain. Cara Terbaik UNTUK Puyeng adalah pelabuhan Yang Lebih Dari gede atau sama DENGAN 50000 UNTUK FTP modus aktif. KARENA Sifat [http://en.wikipedia.org/wiki/Transmission_Control_Protocol TCP] (protokol transportasi Yang mendasari), port Tidak dapat digunakan Segera Kembali Masing-Masing setelah sambungan. Oleh KARENA ITU, Berbagai pelabuhan Tidak boleh Terlalu Kecil UNTUK mencegah kegagalan beberapa mentransfer Kecil file. Berbagai pelabuhan 50 Harus Cukup Dalam, kebanyakan Kasus.
<div align="center">
<div align="center">
[[Gambar: Settings_activemode.png | Screenshot dari dialog pengaturan filezilla 3 menampilkan halaman konfigurasi untuk mode aktif].]
[[Image:Settings_activemode.png|Screenshot of settings dialog of FileZilla 3 showing configuration page for active mode.]]
</div>
</div>


== Menyiapkan dan pengujian filezilla Server ==
== Setting up and testing FileZilla Server ==


Menyiapkan server sangat mirip dengan pengaturan klien, dengan perbedaan utama adalah bahwa peran modus aktif dan pasif dibalik.
{{Warning|The content of this section is '''outdated''' and '''needs to be adapted to apply''' to FileZilla Server version '''''1.x'''''}}


Sebuah kesalahan umum, terutama oleh pengguna dengan router NAT, yang dalam pengujian server. Jika Anda berada dalam jaringan lokal Anda, Anda hanya dapat menguji menggunakan alamat IP lokal server. Menggunakan alamat eksternal dari dalam mungkin akan gagal, dan salah satu dari berikut dapat terjadi:
Setting up the server is very similar to setting up the client, with the main difference being that the roles of active and passive mode are reversed.
* Ini benar-benar bekerja (mengherankan - dan itu mungkin berarti sesuatu yang lain yang salah ...)
* Blok router akses ke alamat eksternal dari dalam, karena mengidentifikasi sebagai kemungkinan serangan
* Router meneruskan koneksi ke ISP, yang kemudian blok itu sebagai kemungkinan serangan
Bahkan jika tes bekerja, tidak ada jaminan bahwa pengguna eksternal benar-benar dapat terhubung ke server Anda dan mentransfer file. Satu-satunya cara yang dapat diandalkan untuk menguji server Anda adalah untuk mencoba menghubungkan dari sebuah sistem eksternal,''''di luar LAN Anda.


=== === Modus Aktif
A common mistake, especially by users with NAT routers, is in testing the server. If you are within your local network, you can only test using the local IP address of the server. Using the external address from the inside will probably fail, and one of the following may happen:
* It actually works (surprisingly - and it probably means something else is wrong ...)
* The router blocks access to its own external address from the inside, due to identifying it as a possible attack
* The router forwards the connection to your ISP, which then blocks it as a possible attack
Even if the test works, there is no guarantee that an external user can really connect to your server and transfer files. The only reliable way to test your server is to try connecting from an external system, ''outside'' of your LAN.


Pastikan FileZilla Server diperbolehkan untuk membangun koneksi keluar ke port sewenang-wenang, karena klien kontrol port yang digunakan.
=== Active mode ===


Di ujung sambungan lokal, filezilla Server mencoba untuk menggunakan port yang kurang dari koneksi kontrol (misalnya port 20 jika server mendengarkan pada port 21). Namun, hal ini tidak selalu mungkin - jadi jangan bergantung pada itu.
Make sure FileZilla Server is allowed to establish outgoing connections to arbitrary ports, since the client controls which port to use.


=== === Modus pasif
On the local end of the connection, FileZilla Server tries to use a port one less than that of the control connection (e.g. port 20 if server is listening on port 21). However, this is not always possible - so don't rely on it.


Konfigurasi server sangat mirip dengan konfigurasi klien untuk mode aktif. Dalam mode pasif, server membuka socket dan menunggu klien untuk menyambung ke.
=== Passive mode ===


Secara default, FileZilla Server meminta sistem operasi untuk alamat IP mesin, dan untuk sejumlah pelabuhan bebas. Konfigurasi ini hanya dapat bekerja jika Anda terhubung ke internet secara langsung tanpa router NAT dan jika Anda telah mengatur firewall Anda untuk membolehkan koneksi masuk pada semua port lebih besar dari 1024.
The server configuration is very similar to client configuration for active mode. In passive mode, the server opens a socket and waits for the client to connect to it.


Jika Anda memiliki router NAT, Anda perlu memberitahu FileZilla Server alamat IP eksternal atau koneksi pasif mode tidak akan bekerja dengan klien di luar jaringan lokal Anda:
By default, FileZilla Server asks the operating system for the machine's IP address, and for a free port number. This configuration can only work if you are connected to the internet directly without any NAT router and if you have set your firewall to allow incoming connections on all ports greater than 1024.
* Jika Anda memiliki alamat IP tetap eksternal, Anda dapat memasukkannya dalam dialog konfigurasi filezilla Server.
* Jika Anda memiliki alamat IP dinamis, Anda dapat membiarkan filezilla server mendapatkan alamat IP eksternal Anda dari situs web khusus secara otomatis. Kecuali versi FileZilla Server, tidak ada informasi akan diserahkan ke situs web itu.
Jika ragu, gunakan pilihan kedua.


Jika Anda tidak ingin mengizinkan koneksi masuk pada semua port, atau jika Anda memiliki router NAT, Anda perlu memberitahu Server filezilla untuk menggunakan berbagai port tertentu untuk koneksi mode pasif. Anda akan memiliki untuk membuka port dalam firewall Anda. Jika Anda memiliki router NAT, Anda perlu untuk maju port ini untuk mesin filezilla lokal Server diinstal pada. Tergantung pada model router Anda, Anda dapat maju berbagai port atau Anda perlu untuk maju semua port individual.
If you have a NAT router, you need to tell FileZilla Server your external IP address or passive mode connections will not work with clients outside your local network:
* If you have a fixed external IP address, you can enter it in the configuration dialog of FileZilla Server.
* If you have a dynamic IP address, you can let FileZilla Server obtain your external IP address from a special website automatically. Except your version of FileZilla Server, no information will be submitted to that website.
If in doubt, use the second option.


Port yang valid dapat 1-65535, namun port kurang dari 1024 dicadangkan untuk protokol lain. Cara terbaik adalah untuk memilih port> = 50000 untuk FTP mode pasif. Karena sifat [http://en.wikipedia.org/wiki/Transmission_Control_Protocol TCP] (protokol transport yang mendasari), port tidak dapat digunakan kembali segera setelah masing-masing sambungan. Oleh karena itu berbagai port tidak boleh terlalu kecil atau transfer beberapa file kecil bisa gagal. Berbagai port 50 harus cukup dalam kebanyakan kasus.
If you do not want to allow incoming connections on all ports, or if you have a NAT router, you need to tell FileZilla Server to use a specific range of ports for passive mode connections. You will have to open these ports in your firewall. If you have a NAT router, you need to forward these ports to the local machine FileZilla Server is installed on. Depending on your router model, you can either forward a range of ports or you need to forward all ports individually.
 
Valid ports can be from 1 to 65535, however ports less than 1024 are reserved for other protocols. It is best to choose ports >= 50000 for passive mode FTP. Due to the nature of [http://en.wikipedia.org/wiki/Transmission_Control_Protocol TCP] (the underlying transport protocol), a port cannot be reused immediately after each connection. Hence the range of ports should not be too small or transfers of multiple small files can fail. A range of 50 ports should be sufficient in most cases.


<div align="center">
<div align="center">
[[Gambar: Serversettings_passive.png | Screenshot dari dialog seting Server filezilla menampilkan halaman konfigurasi untuk mode pasif].]
[[Image:Settings_passivemode_FZServer.png||Screenshot of settings dialog of FileZilla Server showing configuration page for passive mode.]]
</ Div>
</div>


== Masalah ==
== Troubleshooting ==
Berikut ini adalah beberapa saran pemecahan masalah:
The following are a few troubleshooting suggestions:


Sayangnya, banyak personal firewall dan router konsumen cacat atau dalam beberapa kasus, bahkan secara aktif sabotase FTP (misalnya [http://www.gbnetwork.co.uk/smcftpd/ SMC Barricade v1.2]). Pertama-tama, seperti dengan semua perangkat lunak, Anda harus menjaga semuanya diperbarui. Ini termasuk perangkat lunak firewall serta versi firmware router Anda.
Unfortunately, many personal firewalls and consumer routers are flawed or in some cases, even actively sabotage FTP (e.g. [http://www.gbnetwork.co.uk/smcftpd/ SMC Barricade V1.2]). First of all, as with all software, you should keep everything updated. This includes the firewall software as well as the firmware version of your router.


Jika itu tidak membantu, Anda mungkin ingin mencoba untuk'''uninstall''' firewall Anda untuk melihat apa yang terjadi. Cukup menonaktifkan firewall Anda mungkin tidak bekerja, karena beberapa firewall tidak dapat sepenuhnya dinonaktifkan.
If that does not help, you might want to try to '''uninstall''' your firewall to see what happens. Simply disabling your firewall might not work, as some firewalls cannot be fully disabled. In particular, most firewalls install virtual device drivers which cannot be disabled other than by uninstalling them. Also check for hidden firewalls. Programs such as virus scanners often have firewall functionality as well.


Jika memungkinkan, cobalah untuk koneksi langsung ke internet tanpa router.
If possible, try to connect directly to the internet without a router by plugging your computer directly into your modem. If you have a combination modem/router device, try putting it into bridge mode to disable the routing part.


Jika Anda mencoba untuk setup server dan bekerja dengan baik dalam LAN Anda, tetapi tidak dapat dijangkau dari luar, cobalah mengubah port mendengarkan. Beberapa ISP tidak suka pelanggan mereka untuk host server dan mereka mungkin memblokir port dengan angka di bawah 1024.
If you are trying to setup a server and it works fine within your LAN but is not reachable from the outside, try changing the listening port. Some ISPs don't like their customers to host servers and they may block ports with numbers under 1024.


Masalah lain mungkin terjadi jika Anda hosting server FTP pada port default 21. Mungkin ada firewall di sisi ISP koneksi Anda yang dapat melakukan hal-hal aneh seperti mengubah port untuk perintah PASV. Coba gunakan port non-default untuk server FTP Anda.
Another issue may occur if you are hosting an FTP server on default port 21. There might be a firewall at the ISP side of your connection which can do odd things like changing the port for PASV commands. Try using another non-default port for your FTP server.


Jika Anda mengalami "tidak dapat membuka koneksi data" secara acak (yaitu, ftp client dapat terhubung ke server ftp tanpa masalah untuk koneksi banyak sampai menemukan masalah ini), salah satu alasan yang mungkin adalah bahwa PC klien Anda anti-virus perangkat lunak dikonfigurasi untuk memblokir koneksi keluar pada port rentang tertentu. Ketika koneksi ftp Anda berjalan dalam mode pasv, sisi-klien port keluar yang dipilih secara acak dan beberapa dari mereka dipilih secara acak port dapat diblokir oleh perangkat lunak anti-virus. Untuk mengidentifikasi masalah ini, baca anti-virus log Anda pada klien. Secara umum, perangkat lunak apapun yang dapat memblokir port tertentu rentang keluar (seperti firewall PC) dapat menyebabkan kesedihan FTP serupa.
If you encounter "cannot open data connection" on a random basis (i.e., the ftp client can connect to the ftp server without problem for many connections until it encounters this problem), one possible reason may be that your client PC anti-virus software is configured to block outgoing connections on certain ranges of ports. When your ftp connections are running in pasv mode, the client-side outgoing ports are selected randomly and some of those randomly selected ports may be blocked by the anti-virus software. To identify this problem, read your anti-virus log on the client. In general, any software that can block certain ranges of outgoing ports (such as PC firewalls) can cause similar FTP grief.


=== Timeout pada file besar ===
=== Timeouts on large files ===


Jika Anda dapat mentransfer file kecil tanpa masalah, tapi transfer file yang lebih besar akhir dengan timeout, router rusak dan / atau firewall ada antara klien dan server dan menyebabkan masalah.
If you can transfer small files without any issues, but transfers of larger files end with a timeout, a broken router and/or firewall exists between the client and the server and is causing a problem.


Sebagaimana disebutkan di atas, FTP menggunakan dua koneksi TCP: koneksi kontrol untuk mengirimkan perintah dan menerima balasan, dan koneksi data untuk transfer file yang sebenarnya. Ini adalah sifat dari FTP bahwa selama transfer koneksi kontrol tetap benar-benar menganggur.
As mentioned above, FTP uses two TCP connections: a control connection to submit commands and receive replies, and a data connection for actual file transfers. It is the nature of FTP that during a transfer the control connection stays completely idle.


Spesifikasi TCP tidak menetapkan batas pada jumlah waktu koneksi bisa tinggal diam. Kecuali secara eksplisit tertutup, koneksi diasumsikan tetap hidup tanpa batas. Namun, banyak router dan firewall secara otomatis menutup koneksi idle setelah periode waktu tertentu. Lebih buruk lagi, mereka sering tidak memberitahu pengguna, tapi hanya diam-diam menjatuhkan koneksi. Untuk FTP, ini berarti bahwa selama transfer panjang koneksi kontrol dapat bisa jatuh karena terdeteksi sebagai menganggur, tetapi tidak klien maupun server yang diberitahu. Jadi, ketika semua data telah ditransfer, server mengasumsikan koneksi kontrol hidup dan mengirimkan jawaban konfirmasi transfer. Demikian juga, klien menganggap koneksi kontrol hidup dan menunggu jawaban dari server. Tapi karena koneksi kontrol mendapat menjatuhkan tanpa pemberitahuan, jawabannya tidak pernah datang dan akhirnya koneksi timeout akan.
The TCP specifications do not set a limit on the amount of time a connection can stay idle. Unless explicitly closed, a connection is assumed to remain alive indefinitely. However, many routers and firewalls automatically close idle connections after a certain period of time. Worse, they often don't notify the user, but just silently drop the connection. For FTP, this means that during a long transfer the control connection can get dropped because it is detected as idle, but neither client nor server are notified. So when all data has been transferred, the server assumes the control connection is alive and it sends the transfer confirmation reply. Likewise, the client thinks the control connection is alive and it waits for the reply from the server. But since the control connection got dropped without notification, the reply never arrives and eventually the connection will timeout.


Dalam upaya untuk memecahkan masalah ini, spesifikasi TCP termasuk cara untuk mengirim''tetap-hidup''pada paket koneksi TCP jika tidak menganggur, untuk memberitahu semua pihak yang terlibat bahwa sambungan masih hidup dan dibutuhkan. Namun, spesifikasi TCP juga membuatnya sangat jelas bahwa hidup terus-paket tidak dapat dikirim lebih sering dari sekali setiap dua jam. Oleh karena itu, dengan toleransi ditambahkan untuk latency jaringan, koneksi dapat tetap siaga sampai 2 jam dan 4 menit.
In an attempt to solve this problem, the TCP specifications include a way to send ''keep-alive packets'' on otherwise idle TCP connections, to tell all involved parties that the connection is still alive and needed. However, the TCP specifications also make it very clear that these keep-alive packets should not be sent more often than once every two hours. Therefore, with added tolerance for network latency, connections can stay idle for up to 2 hours and 4 minutes.


Namun, banyak router dan firewall drop koneksi yang telah menganggur selama kurang dari 2 jam dan 4 menit. Ini melanggar spesifikasi TCP ([http://filezilla-project.org/specs/rfc5382.txt RFC 5382] membuat ini terutama jelas). Dengan kata lain, semua router dan firewall yang menjatuhkan koneksi idle terlalu dini tidak dapat digunakan untuk transfer FTP panjang. Sayangnya produsen konsumen kelas router dan vendor firewall tidak peduli tentang spesifikasi ... semua yang mereka pedulikan adalah mendapatkan uang Anda (dan hanya memberikan hampir tidak bekerja sampah kualitas terendah).
However, many routers and firewalls drop connections that have been idle for less than 2 hours and 4 minutes. This violates the TCP specifications ([http://filezilla-project.org/specs/rfc5382.txt RFC 5382] makes this especially clear). In other words, all routers and firewalls that are dropping idle connections too early cannot be used for long FTP transfers. Unfortunately manufacturers of consumer-grade router and firewall vendors do not care about specifications ... all they care about is getting your money (and only deliver barely working lowest quality junk).


Untuk mengatasi masalah ini, Anda harus uninstall firewall router yang terkena dan mengganti yang rusak dengan lebih baik-kualitas yang.
To solve this problem, you need to uninstall affected firewalls and replace faulty routers with better-quality ones.


== Menyiapkan FileZilla Server dengan Windows Firewall ==
== Setting up FileZilla Server with Windows Firewall ==


Jika Anda mengalami masalah dengan pengaturan Server filezilla untuk menjalankan belakang Windows Firewall (khusus, ia gagal pada "Daftar" dan klien menerima "Gagal untuk menerima direktori daftar" kesalahan), Anda harus menambahkan Server aplikasi filezilla untuk Pengecualian Windows Firewall yang daftar. Untuk melakukannya, ikuti langkah berikut:
If you are having problems with setting up FileZilla Server to run behind Windows Firewall (specifically, it fails on "List" and the client receives a "Failed to receive directory listing" error), you must add the FileZilla Server application to Windows Firewall's Exceptions list. To do this, follow these steps:


# Buka Windows Firewall di bawah Control Panel.
# Open Windows Firewall under Control Panel.
# Jika menggunakan Vista, klik "Ubah Pengaturan"
# If using Vista, click "Change Settings"
# Pilih "Exceptions" tab.
# Select the "Exceptions" tab.
# Klik "Add Program ..."
# Click "Add program..."
# JANGAN pilih "FileZilla Server Antarmuka" dari daftar, bukan klik pada "Browse ..."
# Do NOT select "FileZilla Server Interface" from the list, instead click on "Browse..."
# Cari direktori anda menginstal Server filezilla untuk (biasanya "C: \ Program Files \ FileZilla Server \")
# Locate the directory you installed FileZilla Server to (normally "C:\Program Files\FileZilla Server\")
# Double klik atau pilih "server.exe filezilla" dan tekan terbuka (Sekali lagi, TIDAK "FileZilla Server Interface.exe")
# Double click or select "FileZilla server.exe" and press open (Once again, NOT "FileZilla Server Interface.exe")
# Pilih "server.exe filezilla" dari daftar dan klik "Ok"
# Select "FileZilla server.exe" from the list and click "Ok"
# Pastikan bahwa "FileZilla server.exe" ditambahkan ke daftar pengecualian dan bahwa ia memiliki tanda centang pada kotak di sebelahnya
# Verify that "FileZilla server.exe" is added to the exceptions list and that it has a check mark in the box next to it
# Tekan "Ok" untuk menutup jendela
# Press "Ok" to close the window
# Open a command prompt with administrative rights and execute the following command: ''netsh advfirewall set global statefulftp disable''


Mode pasif sekarang harus bekerja. Jika Anda masih mengalami masalah koneksi (dari komputer lain atau di luar jaringan), periksa pengaturan router anda atau mencoba untuk menambahkan nomor port pada [[Windows]] pengaturan Firewall terletak di tab Pengecualian.
Passive mode should now work. If you are still having problems connecting (from another computer or outside the network), check your router settings or try to add the port number in the [[Windows]] Firewall settings located in the Exceptions tab.


Lihat artikel Microsoft kb 931130 tentang menjalankan filezilla dengan "Routing dan Remote Access" atau "Application Layer Gateway" layanan diaktifkan.
See the Microsoft kb article 931130 about running FileZilla with the "Routing and Remote Access" or the "Application Layer Gateway" service enabled.
http://support.microsoft.com/kb/931130
http://support.microsoft.com/kb/931130
== Setting up FileZilla Server with Windows 8 Firewall ==
These are the instructions if your operating system is Windows 8 - the interface is slightly different from that described above in [[Network Configuration#Setting up FileZilla Server with Windows Firewall|Setting up FileZilla Server with Windows Firewall]].
Under Windows 8 you must allow the FileZilla Server application through Windows Firewall. To do this, follow these steps:
# Move mouse to upper right corner and click the magnifying glass search icon, and type "firewall" (without the double quotes) in the Search box and then click the "Settings" text. Or, hold down the Windows logo key on the keyboard and press the I key, select the text "Control Panel" and press Enter, in the Search Control Panel area at top right type "firewall". In either case, now click the "Allow an app through Windows Firewall" that should appear.
# Click "Change Settings" and a new button should appear titled "Allow another app..."
# Click "Allow another app..."
# A window titled "Add an app" should appear; do not do anything in this step.
# Do NOT select "FileZilla Server Interface" from the list, instead click on "Browse..."
# Locate the directory you installed FileZilla Server to (normally "C:\Program Files\FileZilla Server\")
# Double click or select "FileZilla server.exe" and press open (Once again, NOT "FileZilla Server Interface.exe")
# Your mouse pointer should now return to the "Add an app" window; scroll down the list and select "FileZilla server.exe" and click "Add".
# Your mouse pointer should now return to the Windows Firewall Allowed apps window; verify that "FileZilla server.exe" is added to the allowed apps and features list and that it has a check mark in either the Private box or the Public box. Choose Private if you want the server accessible only from within your local network, and choose Public if you want the server accessible from outside your local network (this might include clients connected wirelessly to your network).
# Press "Ok" to close the Windows Firewall window
# Open a command prompt with administrative rights and execute the following command: ''netsh advfirewall set global statefulftp disable''
If you are still having problems see the advice at the end of section [[Network Configuration#Setting up FileZilla Server with Windows Firewall|Setting up FileZilla Server with Windows Firewall]] above or search Microsoft Knowledge base for Firewall related articles.

Latest revision as of 00:33, 29 September 2023

Setting up network components for FTP is not trivial for use outside your LAN (Local Area Network). Since so many firewalls and routers exist, it is impractical to give detailed step-by-step instructions suitable for every user. It is important to understand the basics of the FTP protocol in order to configure FileZilla and the routers and/or firewalls involved. This documentation describes the history of the FTP and how some aspects of the protocol work. Reading it carefully will save you a lot of trouble setting up FTP.

Background

This section provides an overview of the historical and technical background of the FTP protocol. For detailed in-depth information see specifications.

Historical Background

In the fast living world of the internet, the File Transfer Protocol is not just old, it's ancient. Early drafts of the protocol go back as far as 1971, and the current specifications are from 1985. The protocol might even be older than you!

Back then, the Internet was mainly used by universities and research centers. The community was small, many users knew each other and all were collaborating together. The internet was a friendly, trusting place. Security was not much of a concern.

A lot has changed since then. The Internet is now ubiquitous, with millions of users communicating with each other in many different ways. It is also a more hostile place. The availability and openness has attracted malicious users who exploit design limitations, incomplete implementations, bugs, and the inexperience of other users.

Several attempts have been made to address these problems:

  • NAT (Network Address Translation) routers. Many hosts and routers on the internet use the IPv4 protocol. The number of hosts connected to the internet has reached IPV4's design limit for the number of addresses (IPv6 is designed to relieve this). NAT routers allow multiple systems within a LAN to connect to the outside world with one external IP address.
  • Personal firewalls try to protect personal computers from attacks by malicious users.

Unfortunately, both NAT and personal firewalls conflict with FTP more often than not. To make things worse, some are themselves flawed, causing additional problems regarding FTP.

Technical background

What distinguishes FTP from most other protocols is the use of secondary connections for file transfers. When you connect to an FTP server, you are actually making two connections. First, the so-called control connection is established, over which FTP commands and their replies are transferred. Then, in order to transfer a file or a directory listing, the client sends a particular command over the control connection to establish the data connection.

The data connection can be established two different ways, using active mode or passive mode.

In passive mode, which is recommended (see below), the client sends the PASV command to the server, and the server responds with an address. The client then issues a command to transfer a file or to get a directory listing, and establishes a secondary connection to the address returned by the server.

In active mode, the client opens a socket on the local machine and tells its address to the server using the PORT command. Once the client issues a command to transfer a file or listing, the server will connect to the address provided by the client.

In both cases, the actual file or listing is then transferred over the data connection.

Generally, establishing outgoing connections requires less configuration on the routers/firewalls involved than establishing incoming connections. In passive mode, the connection is outgoing on the client side and incoming on the server side and in active mode this is reversed. Note that the only differences are in establishing a connection. Once established, the connection can be used for uploads or downloads.

A common network setup might look like this:

FTP1.png


In passive mode, the router and firewall on the server side need to be configured to accept and forward incoming connections. On the client side, however, only outgoing connections need to be allowed (which will already be the case most of the time).

Analogously, in active mode, the router and firewall on the client side need to be configured to accept and forward incoming connections. Only outgoing connections have to be allowed on the server side.

Since in most cases one server provides a service for many users, it is much easier to configure the router and firewall on the server side once for passive mode than to configure the client's router/firewall for each individual client in active mode. Therefore, passive mode is recommended in most cases.

NAT routers

Most broadband users will have a NAT (Network Address Translation) router between their computer and the internet. This may be a standalone router device (perhaps a wireless router), or be built into a DSL or cable modem. In a NAT environment, all systems behind the NAT router form a Local Area Network (LAN), and each system in the LAN has a local IP address (recognizable as four small numbers separated by dots. See Private addresses). The NAT router itself has a local IP address as well. In addition, the NAT router also has an external IP address by which it is known to the Internet.

An example system might look like this:


FTP2.png


The internal IP addresses are only valid inside the LAN, since they would make little sense to a remote system. Think about a server behind a NAT router. Imagine what might happen if a client requests passive mode, but the server doesn't know the external IP address of the NAT router. If the server sends its internal address to the client, two things could happen:

  • If the client is not behind a NAT, the client would abort since the address is invalid.
  • If the client is behind a NAT, the address given by the server might be the same as a system in the client's own LAN.

Obviously, in both cases passive mode would be impossible.

So if a server is behind a NAT router, it needs to know the external IP address of the router in passive mode. In this case, the server sends the router's external address to the client. The client then establishes a connection to the NAT router, which in turn routes the connection to the server.

Firewalls

Personal firewalls are installed on many systems to protect users from security vulnerabilities in the operating system or applications running on it. Over the internet, malware such as worms try to exploit these flaws to infect your system. Firewalls can help to prevent such an infection. However, firewalls and other security applications can sometimes interfere with non-malicious file transfers.

Especially if using FTP, firewall users might occasionally see messages like this from their firewall: 

Trojan Netbus blocked on port 12345 used by FileZilla.exe

In many cases, this is a false alarm. Any program can choose any port it wants for communication over the internet. FileZilla, then, might choose a port that is coincidentally also the default port of a trojan or some other malware being tracked by your firewall. FileZilla is clean of malware as long as it is downloaded from the official website.

Malicious routers, firewalls and data sabotage

Some routers and firewalls pretend to be smart. They analyze connections and, if they think they detect FTP, they silently change the data exchanged between client and server. If the user has not explicitly enabled this feature, this behavior is essentially data sabotage and can cause various problems.

For an example, imagine a client behind a NAT router trying to connect to the server. Let's further assume that this client does not know it is behind a NAT and wants to use active mode. So it sends the PORT command with the user's local, un-routable IP address to the server: 

PORT 10,0,0,1,12,34

This command tells the server to connect to the address 10.0.0.1 on port 12*256+34 = 3106

The NAT router sees this and silently changes the command to include the external IP address. At the same time, the NAT router will also create a temporary port forwarding for the FTP session, possibly on a different port even: 

PORT 123,123,123,123,24,55

The above command tells the server to connect to the address 123.123.123.123 on port 24*256+55 = 6199

With this behavior, a NAT router allows an improperly configured client to use active mode.

So why is this behavior bad? Essentially, it can cause a number of problems if it is enabled by default, without explicit user consent. The FTP connections in their most basic form appear to work, but as soon as there's some deviation from the basic case, everything will fail, leaving the user stumped:

  • The NAT router blindly assumes some connection uses FTP based on criteria like target ports or the initial server response:
    • The used protocol is detected as FTP, yet there is no guarantee that this is true (a false positive). Though unlikely, it is conceivable that a future revision of the FTP protocol might change the syntax of the PORT command. A NAT router modifying the PORT command would then silently change things it does not support and thus break the connection.
    • The router's protocol detection can fail to recognize an FTP connection (a false negative). Say the router only looks at the target port, and if it is 21, it detects it as FTP. As such, active mode connections with an improperly configured client to servers running on port 21 will work, but connections to other servers on non-standard ports will fail.
  • Obviously, a NAT router can no longer tamper with the connection as soon as an encrypted FTP session is used, again leaving the user clueless why it works for normal FTP but not for encrypted FTP.
  • Say a client behind a NAT router sends "PORT 10,0,0,1,12,34". How does the NAT router know the client is improperly configured? It is also possible that the client is properly configured, yet merely wants to initiate an FXP (server-to-server) transfer between the server it is connected to and another machine in the server's own local network.

Therefore, having protocol specific features enabled in a NAT router by default can create significant problems. The solution to all this, then, is to know your router's settings, and to know the configuration abilities of a router before you set it up. A good NAT router should always be fully protocol-agnostic. The exception is if you as the user have explicitly enabled this feature, knowing all its consequences.

While this section only discussed the combination of a NAT router on the client side with active mode, the same applies to a server behind a NAT router and the reply to the PASV command.

Setting up FileZilla Client

If you're running FileZilla 3, it's recommended you run the network configuration wizard. It will guide you through the necessary steps and can test your configuration after set-up.

Obviously, if you want to connect to any server, you need to tell your firewall that FileZilla should be allowed to open connections to other servers. Most normal FTP servers use port 21, SFTP servers use port 22 and FTP over TLS (implicit mode) use port 990 by default. These ports are not mandatory, however, so it's best to allow outgoing connections to arbitrary remote ports.

Since many servers on the internet are misconfigured and don't support both transfer modes, it's recommended that you configure both transfer modes on your end.

Passive mode

In passive mode, the client has no control over what port the server chooses for the data connection. Therefore, in order to use passive mode, you'll have to allow outgoing connections to all ports in your firewall.

Active mode

In active mode, the client opens a socket and waits for the server to establish the transfer connection.

By default, FileZilla Client asks the operating system for the machine's IP address and for the number of a free port. This configuration can only work if you are connected to the internet directly without any NAT router, and if you have set your firewall to allow incoming connections on all ports greater than 1024.

If you have a NAT router, you need to tell FileZilla your external IP address in order for active mode connections to work with servers outside your local network:

  • If you have a fixed external IP address, you can enter it in FileZilla's configuration dialog.
  • If you have a dynamic IP address, you can authorize FileZilla to obtain your external IP address from a special website. This will occur automatically each time FileZilla is started. No information will be submitted to the website (regardless of FileZilla version).

If in doubt, use the second option.

If you do not want to allow incoming connections on all ports, or if you have a NAT router, you need to tell FileZilla to use a specific range of ports for active mode connections. You will have to open these ports in your firewall. If you have a NAT router, you need to forward these ports to the local machine FileZilla is installed on. Depending on your router model, you can either forward a range of ports or you need to forward all ports individually.

Valid ports can be from 1 to 65535; however, ports less than 1024 are reserved for other protocols. It is best to choose ports greater than or equal to 50000 for active mode FTP. Due to the nature of TCP (the underlying transport protocol), a port cannot be reused immediately after each connection. Therefore, the range of ports should not be too small to prevent the failure of transfers of multiple small files. A range of 50 ports should be sufficient in most cases.

Screenshot of settings dialog of FileZilla 3 showing configuration page for active mode.

Setting up and testing FileZilla Server

Warning: The content of this section is outdated and needs to be adapted to apply to FileZilla Server version 1.x

Setting up the server is very similar to setting up the client, with the main difference being that the roles of active and passive mode are reversed.

A common mistake, especially by users with NAT routers, is in testing the server. If you are within your local network, you can only test using the local IP address of the server. Using the external address from the inside will probably fail, and one of the following may happen:

  • It actually works (surprisingly - and it probably means something else is wrong ...)
  • The router blocks access to its own external address from the inside, due to identifying it as a possible attack
  • The router forwards the connection to your ISP, which then blocks it as a possible attack

Even if the test works, there is no guarantee that an external user can really connect to your server and transfer files. The only reliable way to test your server is to try connecting from an external system, outside of your LAN.

Active mode

Make sure FileZilla Server is allowed to establish outgoing connections to arbitrary ports, since the client controls which port to use.

On the local end of the connection, FileZilla Server tries to use a port one less than that of the control connection (e.g. port 20 if server is listening on port 21). However, this is not always possible - so don't rely on it.

Passive mode

The server configuration is very similar to client configuration for active mode. In passive mode, the server opens a socket and waits for the client to connect to it.

By default, FileZilla Server asks the operating system for the machine's IP address, and for a free port number. This configuration can only work if you are connected to the internet directly without any NAT router and if you have set your firewall to allow incoming connections on all ports greater than 1024.

If you have a NAT router, you need to tell FileZilla Server your external IP address or passive mode connections will not work with clients outside your local network:

  • If you have a fixed external IP address, you can enter it in the configuration dialog of FileZilla Server.
  • If you have a dynamic IP address, you can let FileZilla Server obtain your external IP address from a special website automatically. Except your version of FileZilla Server, no information will be submitted to that website.

If in doubt, use the second option.

If you do not want to allow incoming connections on all ports, or if you have a NAT router, you need to tell FileZilla Server to use a specific range of ports for passive mode connections. You will have to open these ports in your firewall. If you have a NAT router, you need to forward these ports to the local machine FileZilla Server is installed on. Depending on your router model, you can either forward a range of ports or you need to forward all ports individually.

Valid ports can be from 1 to 65535, however ports less than 1024 are reserved for other protocols. It is best to choose ports >= 50000 for passive mode FTP. Due to the nature of TCP (the underlying transport protocol), a port cannot be reused immediately after each connection. Hence the range of ports should not be too small or transfers of multiple small files can fail. A range of 50 ports should be sufficient in most cases.

Screenshot of settings dialog of FileZilla Server showing configuration page for passive mode.

Troubleshooting

The following are a few troubleshooting suggestions:

Unfortunately, many personal firewalls and consumer routers are flawed or in some cases, even actively sabotage FTP (e.g. SMC Barricade V1.2). First of all, as with all software, you should keep everything updated. This includes the firewall software as well as the firmware version of your router.

If that does not help, you might want to try to uninstall your firewall to see what happens. Simply disabling your firewall might not work, as some firewalls cannot be fully disabled. In particular, most firewalls install virtual device drivers which cannot be disabled other than by uninstalling them. Also check for hidden firewalls. Programs such as virus scanners often have firewall functionality as well.

If possible, try to connect directly to the internet without a router by plugging your computer directly into your modem. If you have a combination modem/router device, try putting it into bridge mode to disable the routing part.

If you are trying to setup a server and it works fine within your LAN but is not reachable from the outside, try changing the listening port. Some ISPs don't like their customers to host servers and they may block ports with numbers under 1024.

Another issue may occur if you are hosting an FTP server on default port 21. There might be a firewall at the ISP side of your connection which can do odd things like changing the port for PASV commands. Try using another non-default port for your FTP server.

If you encounter "cannot open data connection" on a random basis (i.e., the ftp client can connect to the ftp server without problem for many connections until it encounters this problem), one possible reason may be that your client PC anti-virus software is configured to block outgoing connections on certain ranges of ports. When your ftp connections are running in pasv mode, the client-side outgoing ports are selected randomly and some of those randomly selected ports may be blocked by the anti-virus software. To identify this problem, read your anti-virus log on the client. In general, any software that can block certain ranges of outgoing ports (such as PC firewalls) can cause similar FTP grief.

Timeouts on large files

If you can transfer small files without any issues, but transfers of larger files end with a timeout, a broken router and/or firewall exists between the client and the server and is causing a problem.

As mentioned above, FTP uses two TCP connections: a control connection to submit commands and receive replies, and a data connection for actual file transfers. It is the nature of FTP that during a transfer the control connection stays completely idle.

The TCP specifications do not set a limit on the amount of time a connection can stay idle. Unless explicitly closed, a connection is assumed to remain alive indefinitely. However, many routers and firewalls automatically close idle connections after a certain period of time. Worse, they often don't notify the user, but just silently drop the connection. For FTP, this means that during a long transfer the control connection can get dropped because it is detected as idle, but neither client nor server are notified. So when all data has been transferred, the server assumes the control connection is alive and it sends the transfer confirmation reply. Likewise, the client thinks the control connection is alive and it waits for the reply from the server. But since the control connection got dropped without notification, the reply never arrives and eventually the connection will timeout.

In an attempt to solve this problem, the TCP specifications include a way to send keep-alive packets on otherwise idle TCP connections, to tell all involved parties that the connection is still alive and needed. However, the TCP specifications also make it very clear that these keep-alive packets should not be sent more often than once every two hours. Therefore, with added tolerance for network latency, connections can stay idle for up to 2 hours and 4 minutes.

However, many routers and firewalls drop connections that have been idle for less than 2 hours and 4 minutes. This violates the TCP specifications (RFC 5382 makes this especially clear). In other words, all routers and firewalls that are dropping idle connections too early cannot be used for long FTP transfers. Unfortunately manufacturers of consumer-grade router and firewall vendors do not care about specifications ... all they care about is getting your money (and only deliver barely working lowest quality junk).

To solve this problem, you need to uninstall affected firewalls and replace faulty routers with better-quality ones.

Setting up FileZilla Server with Windows Firewall

If you are having problems with setting up FileZilla Server to run behind Windows Firewall (specifically, it fails on "List" and the client receives a "Failed to receive directory listing" error), you must add the FileZilla Server application to Windows Firewall's Exceptions list. To do this, follow these steps:

  1. Open Windows Firewall under Control Panel.
  2. If using Vista, click "Change Settings"
  3. Select the "Exceptions" tab.
  4. Click "Add program..."
  5. Do NOT select "FileZilla Server Interface" from the list, instead click on "Browse..."
  6. Locate the directory you installed FileZilla Server to (normally "C:\Program Files\FileZilla Server\")
  7. Double click or select "FileZilla server.exe" and press open (Once again, NOT "FileZilla Server Interface.exe")
  8. Select "FileZilla server.exe" from the list and click "Ok"
  9. Verify that "FileZilla server.exe" is added to the exceptions list and that it has a check mark in the box next to it
  10. Press "Ok" to close the window
  11. Open a command prompt with administrative rights and execute the following command: netsh advfirewall set global statefulftp disable

Passive mode should now work. If you are still having problems connecting (from another computer or outside the network), check your router settings or try to add the port number in the Windows Firewall settings located in the Exceptions tab.

See the Microsoft kb article 931130 about running FileZilla with the "Routing and Remote Access" or the "Application Layer Gateway" service enabled. http://support.microsoft.com/kb/931130

Setting up FileZilla Server with Windows 8 Firewall

These are the instructions if your operating system is Windows 8 - the interface is slightly different from that described above in Setting up FileZilla Server with Windows Firewall.

Under Windows 8 you must allow the FileZilla Server application through Windows Firewall. To do this, follow these steps:

  1. Move mouse to upper right corner and click the magnifying glass search icon, and type "firewall" (without the double quotes) in the Search box and then click the "Settings" text. Or, hold down the Windows logo key on the keyboard and press the I key, select the text "Control Panel" and press Enter, in the Search Control Panel area at top right type "firewall". In either case, now click the "Allow an app through Windows Firewall" that should appear.
  1. Click "Change Settings" and a new button should appear titled "Allow another app..."
  2. Click "Allow another app..."
  3. A window titled "Add an app" should appear; do not do anything in this step.
  4. Do NOT select "FileZilla Server Interface" from the list, instead click on "Browse..."
  5. Locate the directory you installed FileZilla Server to (normally "C:\Program Files\FileZilla Server\")
  6. Double click or select "FileZilla server.exe" and press open (Once again, NOT "FileZilla Server Interface.exe")
  7. Your mouse pointer should now return to the "Add an app" window; scroll down the list and select "FileZilla server.exe" and click "Add".
  8. Your mouse pointer should now return to the Windows Firewall Allowed apps window; verify that "FileZilla server.exe" is added to the allowed apps and features list and that it has a check mark in either the Private box or the Public box. Choose Private if you want the server accessible only from within your local network, and choose Public if you want the server accessible from outside your local network (this might include clients connected wirelessly to your network).
  9. Press "Ok" to close the Windows Firewall window
  10. Open a command prompt with administrative rights and execute the following command: netsh advfirewall set global statefulftp disable

If you are still having problems see the advice at the end of section Setting up FileZilla Server with Windows Firewall above or search Microsoft Knowledge base for Firewall related articles.

Retrieved from "https://wiki.filezilla-project.org/wiki/index.php?title=Network_Configuration&oldid=53096"