Setting external IP w/ IIS FTP

[Nathan Strom]

Using IIS 6.0 FTP service on Windows Server 2003. Server is on a
static IP, behind NAT on a Linksys BEFSR14v2 router.

I've configured the passive port range for the server to use by
setting the PassivePortRange key in the metabase; this is working
fine. Unfortunately, I can't seem to find a way to tell IIS to use my
external IP when it reports to a client's PASV command. I would think
this option would go hand in hand with setting the port range to use,
but couldn't find anything in the metabase key index.

Newer versions of most FTP server software packages (in my experience,
at least Bulletproof FTP Server and Serv-U) have the option to set the
external IP to report; is Microsoft's official stance that it is the
NAT device's task to do this, and if your NAT device doesn't support
this functionality, you're screwed?

For now, I'm going to install Bulletproof FTP Server. Hopefully
there's just a setting I can't find, but if not, I'm disappointed by
Microsoft -- this seems to be a feature that people want, and it can't
take more than a handful of lines of code to implement.

[Alun Jones [MS MVP]]

In article <20b27143.03091...@posting.google.com>,

nst...@ananzi.co.za (Nathan Strom) wrote:
>Newer versions of most FTP server software packages (in my experience,
>at least Bulletproof FTP Server and Serv-U) have the option to set the
>external IP to report; is Microsoft's official stance that it is the
>NAT device's task to do this, and if your NAT device doesn't support
>this functionality, you're screwed?

It _is_ the NAT's task to do this, because the NAT translates not just
addresses, but also ports. If you quote an external IP address, and an
internal port, the external port that matches that may be mapped to a
different internal address and/or port. It's a potential security fault to
be giving out internal port numbers, as the port given may map to a service
you'd rather people not be throwing random data at.

>For now, I'm going to install Bulletproof FTP Server. Hopefully
>there's just a setting I can't find, but if not, I'm disappointed by
>Microsoft -- this seems to be a feature that people want, and it can't
>take more than a handful of lines of code to implement.

It doesn't take more than a handful of lines to implement, but it is
impossible to implement reliably. Do you really want an FTP server that
works only part of the time?

Alun.
~~~~

[Please don't email posters, if a Usenet response is appropriate.]
--
Texas Imperial Software | Find us at http://www.wftpd.com or email
1602 Harvest Moon Place | al...@texis.com.
Cedar Park TX 78613-1419 | WFTPD, WFTPD Pro are Windows FTP servers.
Fax/Voice +1(512)258-9858 | Try our NEW client software, WFTPD Explorer.