Firewall setup for FTPS connection

Support
1

Hi,
I’m new on Duplicati and I have a problem with FTP connection.

When I try the connection to the Server I get following error message:

Failed to connect: error-id:TestPreparationError, user-information:Error on deleting file: duplicati-access-privileges-test.tmp, error: Timed out trying to connect!

Duplicati is the lates version 2.1.0.2 from November 29 an runs on Windows Server 2019.
The FTP counterpart is a FTP (FTPS only) release on my FritzBox (Router).

The Windows server is behind a firewall. If I allow all traffic in the firewall, the test runs without any problems.

Which ports / settings do I have to allow for an FTPS connection?

2

You’re most likely running into this issue (from Wikipedia): " Because FTP uses a dynamic secondary port (for data channels), many firewalls were designed to snoop FTP protocol control messages in order to determine which secondary data connections they need to allow. However, if the FTP control connection is encrypted using TLS/SSL, the firewall cannot determine the TCP port number of a data connection negotiated between the client and FTP server. Therefore, in many firewalled networks, an FTPS deployment will fail when an unencrypted FTP deployment will work. This problem can be solved with the use of a limited range of ports for data and configuring the firewall to open these ports."

→ check your server’s config and make sure you only allow a certain range of ports for data transfer which you can then open in your FritzBox.

2 Likes
3

NAT and firewall traversal (Wikipedia) describes the problem of incoming connections.

Of the two solutions there, the application level gateway can’t deal with the encryption.

PASV is the alternative, where there are only outgoing connections, so firewall-friendly.

Try one of the below. I’m not sure what happens if you use both but set them in conflict.

image
image864×342 23.9 KB

Opening ports works, but it’d probably have to be in the firewall and maybe Windows too.

EDIT:

https://github.com/robinrodricks/FluentFTP/blob/master/FluentFTP/Enums/FtpDataConnectionType.cs

gives several variations of passive FTP. The Duplicati help text doesn’t attempt description.

C:\Duplicati\duplicati-2.1.0.2_beta_2024-11-29-win-x64-gui>Duplicati.CommandLine help ftp-data-connection-type
  --ftp-data-connection-type (Enumeration): Configure the FTP data connection type
    If this flag is set, the FTP data connection type will be changed to the selected option.
    * values: AutoActive, AutoPassive, PASV, EPSV, PORT, EPRT, PASVEX, PassiveExtended, PASVUSE, PassiveAllowUnroutable
    * default value: AutoPassive
4

Thank you for help!

I made some changes in my firewall rule, now the connection works.

1 Like