Connection timed out to ftp server

[blad3]

It's quite strange but people cannot connect to my ftp server's wan ip using browser, they get connection timed out. However I can access ftp with browser at ftp://127.0.0.1
I can access ftp from remote linux shell as well. I tried testing ftp connection with online ftp testers. They all fail to connect with message 'connection timed out'.

So why am I able to access ftp from remote linux shell but other people cannot? They are using windows.

I've forwarded passive mode port range 50000-50100 tcp as well as port 21 tcp in my router. Firewall is disabled.

[botg]

Logs would be helpful.

[blad3]

There is nothing to log because users cannot even connect to ftp server.
Works fine from remote shell though:

FileZilla Server version 0.9.49 beta
Copyright 2001-2015 by Tim Kosse (tim.kosse@filezilla-project.org.)
https://filezilla-project.org/
Connecting to server 127.0.0.1:14147...
Connected, waiting for authentication
Logged on
(000002)2015.01.19 14:20:57 - (not logged in) (94.247.40.156)> Connected on port 21, sending welcome message...
(000002)2015.01.19 14:20:57 - (not logged in) (94.247.40.156)> 220 FileZilla Server version 0.9.49 beta
(000002)2015.01.19 14:21:00 - (not logged in) (94.247.40.156)> USER anonymous
(000002)2015.01.19 14:21:00 - (not logged in) (94.247.40.156)> 331 Password required for anonymous
(000002)2015.01.19 14:21:01 - (not logged in) (94.247.40.156)> PASS
(000002)2015.01.19 14:21:01 - anonymous (94.247.40.156)> 230 Logged on
(000002)2015.01.19 14:21:01 - anonymous (94.247.40.156)> SYST
(000002)2015.01.19 14:21:01 - anonymous (94.247.40.156)> 215 UNIX emulated by FileZilla
(000002)2015.01.19 14:21:09 - anonymous (94.247.40.156)> QUIT
(000002)2015.01.19 14:21:09 - anonymous (94.247.40.156)> 221 Goodbye
(000002)2015.01.19 14:21:09 - anonymous (94.247.40.156)> disconnected.

[botg]

What does https://ftptest.net/ say?

[blad3]

First time the test passed. But only with simple ftp protocol:

Code: Select all

(000005)2015.01.19 18:22:37 - (not logged in) (94.247.40.156)> Connected on port 21, sending welcome message...
(000005)2015.01.19 18:22:37 - (not logged in) (94.247.40.156)> 220 FileZilla Server version 0.9.49 beta
(000005)2015.01.19 18:22:38 - (not logged in) (94.247.40.156)> CLNT https://ftptest.net on behalf of xx.xx.xxx.xx
(000005)2015.01.19 18:22:38 - (not logged in) (94.247.40.156)> 200 Don't care
(000005)2015.01.19 18:22:38 - (not logged in) (94.247.40.156)> USER anonymous
(000005)2015.01.19 18:22:38 - (not logged in) (94.247.40.156)> 331 Password required for anonymous
(000005)2015.01.19 18:22:38 - (not logged in) (94.247.40.156)> PASS **********************
(000005)2015.01.19 18:22:38 - anonymous (94.247.40.156)> 230 Logged on
(000005)2015.01.19 18:22:39 - anonymous (94.247.40.156)> SYST
(000005)2015.01.19 18:22:39 - anonymous (94.247.40.156)> 215 UNIX emulated by FileZilla
(000005)2015.01.19 18:22:39 - anonymous (94.247.40.156)> FEAT
(000005)2015.01.19 18:22:39 - anonymous (94.247.40.156)> 211-Features:
(000005)2015.01.19 18:22:39 - anonymous (94.247.40.156)>  MDTM
(000005)2015.01.19 18:22:39 - anonymous (94.247.40.156)>  REST STREAM
(000005)2015.01.19 18:22:39 - anonymous (94.247.40.156)>  SIZE
(000005)2015.01.19 18:22:39 - anonymous (94.247.40.156)>  MLST type*;size*;modify*;
(000005)2015.01.19 18:22:39 - anonymous (94.247.40.156)>  MLSD
(000005)2015.01.19 18:22:39 - anonymous (94.247.40.156)>  UTF8
(000005)2015.01.19 18:22:39 - anonymous (94.247.40.156)>  CLNT
(000005)2015.01.19 18:22:39 - anonymous (94.247.40.156)>  MFMT
(000005)2015.01.19 18:22:39 - anonymous (94.247.40.156)>  EPSV
(000005)2015.01.19 18:22:39 - anonymous (94.247.40.156)>  EPRT
(000005)2015.01.19 18:22:39 - anonymous (94.247.40.156)> 211 End
(000005)2015.01.19 18:22:39 - anonymous (94.247.40.156)> PWD
(000005)2015.01.19 18:22:39 - anonymous (94.247.40.156)> 257 "/" is current directory.
(000005)2015.01.19 18:22:40 - anonymous (94.247.40.156)> TYPE I
(000005)2015.01.19 18:22:40 - anonymous (94.247.40.156)> 200 Type set to I
(000005)2015.01.19 18:22:40 - anonymous (94.247.40.156)> PASV
(000005)2015.01.19 18:22:40 - anonymous (94.247.40.156)> 227 Entering Passive Mode (x,x,xxx,xx,195,80)
(000005)2015.01.19 18:22:40 - anonymous (94.247.40.156)> MLSD
(000005)2015.01.19 18:22:50 - anonymous (94.247.40.156)> 425 Can't open data connection for transfer of "/"
(000005)2015.01.19 18:22:50 - anonymous (94.247.40.156)> disconnected.

But after more tries it's again - Error: Connection attempt timed out .
Ftp server works after being idle for quite some time like 30min. I guess it's my crappy router. But then again why it's working all the time from remote shell?
Does it depend on ftp client or what?

[botg]

Different clients do things slightly differently. E.g. your other client might use active mode instead of passive mode, or uses LIST instead of MLSD.

[boco]

Please check if you actually forwarded a range for data ports. We had users who accidentally forwarded only the first and last port.

[blad3]

This is port fw and I guess it's correct.

[botg]

Your screenshot shows port triggering for the built-in firewall, it doesn't show NAT port forwarding rules. It is the latter you want to configure.

[blad3]

Port triggering is the same as port forwarding. At least on my router there are only 3 options in NAT section: Virtual servers, Port triggering, DMZ host. That's it.

[boco]

No, it is not the same. Triggering attempts to open and close ports dynamically if and when it detects a connection on the trigger port. While that might sound good in theory it often fails in practice.

The terms 'Port Forwards' and 'Virtual Servers' are used interchangeably so 'Virtual Servers' is what you want.