FTP/Firewall problems on XP Pro

Hi All,

I've got a problem with several different XP Pro clients with the
built-in firewall enabled, trying to put files on an FTP server.
Hope someone out there can help me solve this. Would rather not begin
installing 3'rd party products or anything.

The connection seems to be created fine many times, but every now and
then it seems as if the built-in firewall drops a reply packet from
the server (or a connection (data) from the server), and the FTP
connection hangs.

I've re-produced the problem on a newly installed XP Pro, with the
firewall enabled.

Steps to reproduce:

On an XP machine with the firewall enabled, create a batch script with
the following contents:

** Begin **
@echo off
start ftp -d -s:commands.txt <ftp server>
ping -n 10 localhost >NUL
start ftp -d -s:commands.txt <ftp server>
ping -n 10 localhost >NUL
start ftp -d -s:commands.txt <ftp server>
ping -n 10 localhost >NUL
start ftp -d -s:commands.txt <ftp server>
ping -n 10 localhost >NUL
start ftp -d -s:commands.txt <ftp server>
ping -n 10 localhost >NUL
start ftp -d -s:commands.txt <ftp server>
** End **

Replace <ftp server> with the name or IP address of the FTP server you
wish to use.

And in the same location, create a text file named "commands.txt" with
the following contents:

** Begin **
<username>
<password>
<60 lines of ls>
bye
** End **

Replace <username> and <password> with your credentials, and <60 lines
of ls> with, well... 60 lines of "ls" commands.

Each "ls" command makes the client use a new port number, for the FTP
server to send the data to.

If you disable the firewall, you can almost start as many instances of
the batch script as you like, but with the firewall enabled, you'll
probably start noticing problems if you start two or more instances
simultaneously (at least i do).

I suspect the problem of getting worse, if the client PC is heavy
loaded.

I can't say for sure that it is always so, but a lot of the time, it
appears to happen mostly to high number ports (above 5000).
I have for sure also seen it on lower ports, but i don't see that at
this moment.

I realize that there may be an issue with the ephemeral port range,
but i think that if that was the problem, disabling the firewall
should not make any difference. Besides, cancelling the hung
connection immediately, makes that series of "ls" commands continue as
nothing happened (usually).

Also, raising the MaxUserPort just seems to raise the high number
ports that gets blocked by the firewall.

Another test i have made, is to install the Free Edition of the
ZoneAlarm Firewall, and the problem seem to disappear when using that
instead of the built-in firewall.

Have also tried making some exceptions in the firewall, but nothing
seems to help. Actually, at some point, it seemed as if making *any*
change to the firewall settings, triggered something and connections
started dropping.

Can there be done anything to tweak the firewall?
Or to make certain traffic bypass it alltogether?

As i understand it, the alg.exe has to get it's hand on the FTP
connection to allow the data connection through the firewall.
But can there be something in that proces that just doesn't happen
quick enough? That is, the firewall drops the connection before the
alg has a chance to open it?

Any ideas?

Thanks.

--
/Sune

.

Relevant Pages

  • Re: Another VPN Issue...Say it aint so...
    ... click on "Services and Ports." ... Now how can I configure the firewall within ... but this time disable Firewall and redo remote access ... to make sure I get a good snap-in connection and see what goes on?!? ...
    (microsoft.public.windows.server.sbs)
  • Re: WDSC, VPN, and RPG Editing
    ... this) and so it drops the ethernet connection. ... to do with firewalls or other ports. ... do with the firewall on my router and the ports that are/aren't ... workstation to port 446 on the iSeries server. ...
    (comp.sys.ibm.as400.misc)
  • Re: Interesting webserver intrusion (apache 1.3.31, mod_ssl 2.8.18, php 4.3.7)
    ... > fairly tight(only allowing 4 ports in), but perhaps I could tighten it ... The host systems firewall rules govern the access to the jailed system. ... What connections does your server need to ... Perhaps there is a 0-day for your ftp server out there. ...
    (Incidents)
  • AdAware, SpyBot S &D, etc. + leave PC connected to Internet
    ... Does it have somehting to dow the Firewall ... with spyware services and adsites, the latter of which can be worse ... What ports are open? ... routers do absolutely zero as far as preventing outbound connection ...
    (comp.security.firewalls)
  • Re: How to close the unnecessary Ports
    ... >> necessary ports for a homeuser and how to close the rest of the ports? ... I assume you are running a hostbased firewall with no server ports ... > know whether it is a statefull or a packet filtering firewall as the ... makes decisions based on the connection as well as the rule base. ...
    (alt.computer.security)
Loading