q000032

Using FTP client software through the firewall.

This article applies to: BlackICE Defender.

SUMMARY

This is a "classic" problem using FTP through any firweall. With FTP, the commands LIST, GET, or MGET fail when sent through a firewall that blocks incoming connections. With our product, that means they fail at a protection level Nervous or higher; it works fine at Cautious or Trusting protection level.

DETAILS

FTP uses an outbound control connection, then asks data to be sent on an inbound connection. Firewalls (like Defender) block inbound connections.

For this reason, Defender ships in "Cautious" mode that blocks only the most dangerous inbound connections, but allows such things as FTP software to work.

At the default protection level of Cautious, you will find that you can connect to an FTP server with no problem. You will also find that as you perform other things like perform a directory listing or download a file, the operations work just fine.

However, as you move your protection level higher--Nervous or Paranoid, certain aspects of FTP fail. For example, the commands LIST, GET, or MGET will fail. The failure occurs because of the blocked inbound connections.

When you perform a directory listing (LIST) or try to GET or MGET a file, the FTP server will initiate a connection to your computer from TCP port 20 to a high TCP port (above port 1023) on your computer. Because all TCP ports are blocked, the FTP server is unable to connect--hence, the failure.

 
Keywords: FTP, LIST, GET, MGET, CuteFTP, VTP Voyager 
Version:  1.8.5.5 
Fixed:     
Modified: 1999-08-27