即使在配置 Azure 入站规则和 Windows 防火墙之后，也无法在 Azure 上的 IIS FTP 服务器上列出目录

Question

I'am running Windows Server 2012 in Azure, and I've configured the FTP server in IIS. When I try to connect the server, it accepts the username and password and log me in but not showing the directory listing.

1. I've tried using FileZilla FTP client to connect and it saying the same error.

    Status: Resolving address of jothiprakashanandan.southindia.cloudapp.azure.com Status: Connecting to 104.211.244.241:21... Status: Connection established, waiting for welcome message... Status: Insecure server, it does not support FTP over TLS. Status: Logged in Status: Retrieving directory listing... Command: PWD Response: 257 "/" is current directory. Command: TYPE I Response: 200 Type set to I. Command: PASV Error: Connection timed out after 20 seconds of inactivity Error: Failed to retrieve directory listing Status: Disconnected from server

2. The inbound rule of Azure is this:

   

3. The VM's firewall inbound rule.

4. However when I try to login from the VM's browser it is working fine and showing the directory list.

Answer 1

In Azure, we should deploy the passive mode FTP , we should add data channel ports range in FTP Firewall Support , then add those ports to NSG and windows firewall inbound rules .

By the way, although the windows firewall seems to allow all traffic that's required, we also need to enable stateful FTP filtering on the firewall:

netsh advfirewall set global StatefulFtp enable

Then restart the FTP windows service and we should be up and running:

net stop ftpsvc
net start ftpsvc

Here is a similar case , same error as you, please refer to it.

Check which port does the FTP site listen on:

Answer 2

It is usually necessary to restart the Microsoft FTP service after enabling the FTP server rules in Windows firewall to have the change take an effect.

Or restarting a whole machine.

See my guide to Installing an FTP Server on Windows using IIS .

Answer 3

The issue was with Azure network NSG. you need to enable the port range on which data is getting transferred.

Added new rule in NSG to open this port range and it worked.

Answer 4

The selected answer is good (passive mode FTP, IIS FTP Firewall Support, NSG, windows firewall).

However, I was missing inbound NAT rules on the load balancer.

https://docs.microsoft.com/en-us/azure/load-balancer/manage-inbound-nat-rules?tabs=inbound-nat-rule-portal