LAN connection to server only problems

[peppie]

Hello folks, I hope someone can help me with this - FTP is not my strong point.

I have been using FileZilla client for some years but have decided to venture into using the server on my local network for internal file transfer - and I have struck some problems setting it up.

Firstly, after installing the server I could not connect from any LAN client and noticed I had error messages on the server app "You appear to be behind a NAT router. Please configure the passive mode settings and forward a range of ports in your router" and "Warning: FTP over TLS is not enabled, users cannot securely log in." Eventually I found out about setting up a TLS certificate and that made both messages disappear from the server log details.

Having done this I was able to connect to the server from a client on the same computer, but, not from clients installed on 2 other computers using exactly the same settings, user details etc.. The server log shows connections and activities for the client on the same computer but does not show activity for the other clients on separate computers. The clients fail to connect and show the message "ECONNREFUSED - Connection refused by server".

Server and clients are the latest versions. The server app is installed on a Windows 10 PC and the 2 clients are on Windows 7 PCs.

Thinking that something appears to be blocking the connections from the separate clients, I disabled the firewall on the Windows 10 computer and have looked for anything in the antivirus settings (Trend Micro) and LAN router (TP Link) settings for clues, but I really can't see anything relevant. One of those clients is able to access my website on the server at my Internet Service Provider, so I can at least say that this client is working ok to an external connection.

Any help would be appreciated.

[botg]

Can you ping the machines?

[peppie]

I have not actually "pinged" between any PCs on my network (and I know what you mean), but I can certainly access any PC from any other PC on my network. Direct access between all PCs (and there are 6 plus of them) is not a problem, the network and file transfer etc capabilities as such is not a problem - only in this instance I am not able to get FileZilla clients on 2 PCs to log onto the FileZilla server on a 3rd PC.

I will add that I have a small app on multiple PCs to interrogate the network and give me a list of ip addresses connected at the time. (Very useful to be able to see when the kids are connected when they shouldn't be). But I would have thought this would also show the ip address of the FileZilla server which it does not. If this IS the case, then maybe access to FilleZilla server is being blocked from the network on that computer??? And if so I have no idea how to unblock it!!!!!!!!

[peppie]

Just adding to the above -

I have just gone into the firewall settings on the computer with FileZilla server on it and set up an inbound and outbound rule for the FileZilla server app. and also done a little fiddling with the settings. This so far does not seem to be the problem as it has not changed anything.

Also, this morning on start up of the server one of the error messages has reappeared , "You appear to be behind a NAT router. Please configure the passive mode settings and forward a range of ports in your router" . Correct me if I am wrong please, but as I understand it this is only an issue if I want to set up external access from the server to and from the internet. At this stage I have no interest/need to do so, I only want to keep access within the local network, so I assume until I know otherwise that I do not have to deal with this error message. Yes or no???

[boco]

For LAN-only operation, you don't need to forward ports or configure the Passive settings at all. The NAT message can be ignored in this case.

(
@botg: Maybe a suggestion - a checkbox for LAN-only operation that
1. silences the NAT message,
2. changes access rules to only answer connections from the current LAN's IPv4 CIDR range and from the current LAN's IPv6 prefix(es) (if any),
3. set Passive settings to LAN default and locks them.

If users see a red NAT error/warning message, they think something is wrong. Which is, in LAN-only operation, not the case.
)


As for the access problems: You didn't play with bindings nor access rules in the settings, right? By default, the server service listens on the listening ports 21 and 990, on all IP addresses of your network interface.

Try a netstat -a -b in a command shell (Admin) and search for:

Code: Select all

  TCP    0.0.0.0:990        xxxxx:0          LISTENING
 [FileZilla Server.exe]
 
  TCP    [::]:990           xxxxx:0          LISTENING
 [FileZilla Server.exe]
 
   TCP    0.0.0.0:21        xxxxx:0          LISTENING
 [FileZilla Server.exe]

   TCP    [::]:21           xxxxx:0          LISTENING
 [FileZilla Server.exe]

  TCP    127.0.0.1:14147    xxxxxx:port      ESTABLISHED
 [FileZilla Server.exe] 

The foreign address is not important, but "FileZilla Server.exe" status must be "LISTENING" on "TCP 0.0.0.0:21" and "TCP 0.0.0.0:990" and their [::] counterparts, by default.

0.0.0.0 = Listen on any available IPv4 address
[::] = Listen on any available IPv6 address

If all entries are there, there's still a rogue firewall or security software blocking access.

[peppie]

Many thanks boco for your help. I have to admit to being an apprentice in any of this sort of area - my working history is that of more like an "mature analog techie" (typical catch cry, "I love what you can do with digital but it scares me!")

As per your suggestion, I opened a command prompt and entered netstat -a and the following is part of what I got. So from what you say I gather that the server is listening ok on the ports it should be.

This seems to add up to me as I can log onto the server from a client on the same computer but not from elsewhere on my network. So yes, maybe there is something blocking access external to this computer and apparently I need to go looking for a blockage.

So far though I haven't found anything. The only possibilities seem to be Windows firewall or Trend Micro anti virus on the server and client's computers, but I have disabled firewalls and added FileZilla to the Trend Micro exception lists and no success so far. I will try a bit more over the coming days, but I am doing a lot of head scratching in an area I am just not really familiar with.

If anyone is able to suggest any other possible solution I am happy to listen.

TCP 0.0.0.0:21 SERVER:0 LISTENING
TCP 0.0.0.0:135 SERVER:0 LISTENING
TCP 0.0.0.0:445 SERVER:0 LISTENING
TCP 0.0.0.0:990 SERVER:0 LISTENING
TCP 0.0.0.0:3261 SERVER:0 LISTENING
TCP 0.0.0.0:5357 SERVER:0 LISTENING
TCP 0.0.0.0:8703 SERVER:0 LISTENING
TCP 0.0.0.0:35621 SERVER:0 LISTENING
TCP 0.0.0.0:35623 SERVER:0 LISTENING
TCP 0.0.0.0:49664 SERVER:0 LISTENING
TCP 0.0.0.0:49665 SERVER:0 LISTENING
TCP 0.0.0.0:49666 SERVER:0 LISTENING
TCP 0.0.0.0:49667 SERVER:0 LISTENING
TCP 0.0.0.0:49674 SERVER:0 LISTENING
TCP 0.0.0.0:49707 SERVER:0 LISTENING
TCP 0.0.0.0:55413 SERVER:0 LISTENING
TCP 0.0.0.0:55414 SERVER:0 LISTENING
TCP 0.0.0.0:61466 SERVER:0 LISTENING
TCP 127.0.0.1:1001 SERVER:0 LISTENING
TCP 127.0.0.1:3260 SERVER:0 LISTENING
TCP 127.0.0.1:14147 SERVER:0 LISTENING
TCP 127.0.0.1:14147 SERVER:54992 ESTABLISHED
TCP 127.0.0.1:35623 SERVER:54944 ESTABLISHED
TCP 127.0.0.1:54857 SERVER:0 LISTENING
TCP 127.0.0.1:54857 SERVER:55146 ESTABLISHED
TCP 127.0.0.1:54944 SERVER:35623 ESTABLISHED
TCP 127.0.0.1:54992 SERVER:14147 ESTABLISHED
TCP 127.0.0.1:55117 SERVER:55118 ESTABLISHED
TCP 127.0.0.1:55118 SERVER:55117 ESTABLISHED
TCP 127.0.0.1:55146 SERVER:54857 ESTABLISHED

TCP [::]:21 SERVER:0 LISTENING
TCP [::]:135 SERVER:0 LISTENING
TCP [::]:445 SERVER:0 LISTENING
TCP [::]:990 SERVER:0 LISTENING
TCP [::]:5357 SERVER:0 LISTENING
TCP [::]:49664 SERVER:0 LISTENING
TCP [::]:49665 SERVER:0 LISTENING
TCP [::]:49666 SERVER:0 LISTENING
TCP [::]:49667 SERVER:0 LISTENING
TCP [::]:49674 SERVER:0 LISTENING
TCP [::]:49707 SERVER:0 LISTENING
TCP [::]:61466 SERVER:0 LISTENING
TCP [::1]:14147 SERVER:0 LISTENING
TCP [::1]:37848 SERVER:0 LISTENING
TCP [::1]:49833 SERVER:0 LISTENING

[peppie]

Just to add a little more to the progress.

I have just now turned off completely the Windows firewall and Trend Micro anti virus on both the server and client computers. Then I confirmed that I could log into the server from a client on the same computer. I used these exact log in settings on the separate client computer - but no go, cannot log onto the server. These computers communicate very well over the local network in every other respect except when running FileZilla.

At this stage I don't have anything else to try. There is no other software on the server computer that I can think might be causing a blockage, nor on the client computer. I have tried another computer running FileZilla client, but no joy either.

My knowledge of local networks and addressing is rather limited, but would any of these problems be caused by my local router??? I have a separate TP Link router controlling the DNS and on the internet end it connects to a cable modem, on the other end to a couple of unmanaged switches then to the local network. But I would have thought the FileZilla address and access would come from the FileZilla server app. and have nothing to do with the local router etc.. Am I right / wrong???

[boco]

Unmanaged switches don't pose a problem. I have a managed one and THESE CAN be a problem. Internet and modem don't matter for LAN-only operation, provided you use the server's LAN-IP to connect. The public IP is invalid inside the router's borders due to the way NAT works. Port forwards are not needed for LAN-only, either.

I used these exact log in settings on the separate client computer - but no go, cannot log onto the server.

Just to get it out of the way - you didn't use localhost, 127.0.0.1 or the like as hostname??? Because these do only work on the same PC the server is on. You cannot use localhost addresses to connect from other PCs, as localhost means "this very same PC you are on".

[peppie]

AHHHHHHHHHHHHHHHHH!!!!!!!! (hits head against wall)

Now I did say that networking etc etc was not my strong point. Many many thanks for picking up my stupidity.

YES, I was entering 127.0.0.1 as the server host name - because I did not think it should be different when doing it from another computer. SOOOOO, once I worked out what you were getting at I went to the other computer and entered the server computers ip address 192.168.1.123 and on another I simply entered it as (wait for it) server (because that's what it IS called). Hole in one , both worked

If you look further up you will see I described myself as a "mature analog techie". My original electronic training was on hard wired relay systems and it can be VERY hard sometimes to forget that way of thinking and adopt digitalise.

Many thanks again - and I hope this helps others. Now I know this is all voluntary - but it would be really nice to have some basic newbie setup explanations somewhere easy to find. This sort of thing can drive you up the wall if you don't know it. I always said computers are worse than bringing up children!!!?