Set a passive port range in Serv-U FTP Server

10/18/2018 2:00 AM

2/16/2022 9:32 PM

FTPs use multiple connections on multiple ports to perform file transfers.

 

Many firewalls "understand" plain-text FTP and can open or close ports dynamically if your configuration specifies "FTP" rather than, for example, "TCP port 21" in firewall rules.

 

However, when FTPS is used, the control channel that the firewall reads is encrypted. So, firewall technicians find they need to open up ranges of high inbound TCP ports for FTPS to work in passive mode. SolarWinds does not recommend using active mode FTPS transfers. Most clients select passive mode transfers for FTPS by default.

 

To avoid extreme ranges - for example, "allow TCP from all to ports 1024-65535" - specific ranges of inbound passive ports can be configured on both your FTP server and your firewall.

 

The instructions below detail how to configure a passive FTP port range on Serv-U, and related instructions detail how to require the use of passive mode transfers in Serv-U.

Serv-U Managed File Transfer & Serv-U FTP Server

1. Open your Serv-U Management Console, then navigate to Global > Limits & Settings > Settings tab.
2. Scroll down until you see the "Network Settings" panel. Fill in a value for the "PASV Port Range". SolarWinds recommends starting with 50000-50009; you can use a narrower port range if you never hit simultaneous transfers; use a wider port range if you support more simultaneous transfers. A range of 10 ports is usually sufficient for the busiest of file transfers. For more information, see Serv-U Server settings.

Notes: Serv-U supports up to 500 passive ports

 

3. Click the "Save" button in the "Network Settings" panel.
4. To test, connect to Serv-U using an FTP client configured to use passive mode. Connect to the server from outside your firewall, attempt several directory listings and transfers, and make sure passive transfers work.