🎥 The full deployment is in the video — the FTP feature install, users, folder permissions, firewall and passive mode, shown live step by step
Every FTP transfer after login rides on a data connection, and in passive mode the server chooses the port for it. If IIS, Windows Firewall and the router each have a different idea of which ports are allowed, logins succeed and transfers fail — the most confusing pattern in FTP. The cure is discipline: choose one small range and write it identically in all three places. This page does it end to end, with example values you replace with your own.
FTP Firewall Support — One Range, Declared Once
Data Channel Port Range50000-50100
External IP Address of Firewall203.0.113.5 (example)
Control port (unchanged)21
Example values only. Your public IP comes from your router or ISP, and your range can be any free block of ports.
1
Choose the Range and Understand What It Limits
Pick a block of about 50–100 ports high in the range, for example 50000-50100. Each simultaneous file transfer or listing uses one port from the block, so 101 ports is generous for a small office. Too small a range shows up as random failures only when several users transfer at once — a maddening fault that is really arithmetic.
2
Place One — IIS FTP Firewall Support
IIS Manager → select the server name at the top of the tree (this setting is server-wide, not per site — looking for it inside the site is the classic dead end).
Open FTP Firewall Support.
Set Data Channel Port Range to 50000-50100.
If clients connect through a NAT router, set External IP Address of Firewall to the router's public IP, so PASV replies announce the reachable address.
Apply, then restart the service: net stop ftpsvc and net start ftpsvc.
3
Place Two — Windows Firewall on the Server
Open the same range inbound for TCP. From an admin command prompt:
Scope it: edit the rule afterwards to allow only your LAN subnet for internal servers, instead of Any.
Know about the shortcut and its limit: netsh advfirewall set global statefulftp enable lets the firewall open data ports dynamically for plain FTP — but it cannot read an encrypted FTPS control channel, so with FTPS the fixed range rule is the only correct method.
4
Place Three — The Router, Only If Clients Are Outside
For internet or branch clients, log in to the router and forward TCP port 21 and TCP ports 50000-50100 to the server's fixed LAN IP. A forward for port 21 alone reproduces the exact login-works-listing-hangs failure from the NAT page in this series. If your ISP uses CGNAT — your router's WAN address is itself a private address — no forwarding will work at all, and the honest answers are a public IP from the ISP or a VPN; the settings cannot fix an address you do not own.
5
Verify Each Layer Separately
LAN test from another PC: Test-NetConnection 192.168.1.10 -Port 21 proves the control port; a real FileZilla upload proves the data range.
Outside test from mobile data: the FileZilla log must show your public IP in the 227 reply — if it shows a 192.168 address, the External IP field is empty or wrong.
Change one thing at a time. Three layers changed at once means three suspects when it still fails.
🔴 One rule before anything else: classic FTP sends the username, the password and every file in plain readable text. Inside a trusted office LAN it still has honest uses. On the open internet it does not — there the answer is FTPS or SFTP, and these pages will keep saying so.
🎥 Watch the Complete FTP Server Deployment
The video sets up the whole FTP server on Windows live — including the fast automated route — so you can follow it on your own server, click by click.
Why must the passive range be set on the server node and not the site
Because in IIS the FTP Firewall Support settings are server-level — they describe how the whole server behaves behind a firewall. Looking inside the individual site's pages for the port range is the most common reason admins conclude the setting does not exist.
How many passive ports do I actually need
One per simultaneous data connection. A small office rarely exceeds a few dozen transfers at once, so 50 to 100 ports is comfortable. Huge ranges add firewall exposure without adding reliability.
Passive works on LAN but not through the router even after forwarding — what else
Check the External IP field in FTP Firewall Support and confirm the router really holds a public IP (no CGNAT). Those two account for nearly every remaining case; after that, read the server's FTP log for what the client actually did.
This guide is based on the Technical Anshu video — Windows FTP Server Deployment Guide for IT Admins • Stuck on a step — ask in the video comments and you will get an answer there 🙏