Windows Defender Firewall Rules for FTP Server Port 21 and Passive Range
FTP and firewalls fight because FTP uses more ports than people expect. Here are the precise rules it needs — and the dangerous shortcuts to refuse.
✍️ Technical Anshu🪟 Windows Defender Firewall⏱️ 9 minute setup
🎥 The full deployment is in the video — the FTP feature install, users, folder permissions, firewall and passive mode, shown live step by step
Most FTP firewall advice online is some version of "disable the firewall and test" — a test that never gets un-done. This page takes the opposite approach: the exact, minimal rules a Windows FTP server needs, created precisely, scoped tightly, and verified. Two rules cover almost every deployment — the control port and your passive range — plus one discipline that matters more than any rule: never an allow-everything rule, not even for five minutes.
The Complete Rule Set for a LAN FTP Server
FTP Control InTCP 21 — allow — LAN subnet only
FTP Passive InTCP 50000-50100 — allow — LAN subnet only
FTPS Implicit (if used)TCP 990 — allow
Everything elseNo rule — default deny stands
Example ports. If a rule is not on a list like this, the FTP server does not need it — whatever a forum post claims.
1
Route One — The Predefined FTP Server Rules
Windows ships the correct rules; they are simply disabled until the role needs them. In Windows Defender Firewall with Advanced Security → Inbound Rules, find the group named FTP Server — it contains FTP Traffic-In (port 21), FTP Passive Traffic-In, and FTP SSL Traffic-In (port 990). Enable the ones your deployment uses. From an admin prompt, the group can be enabled in one line:
netsh advfirewall firewall set rule group="FTP Server" new enable=yes
Know the predefined passive rule's weakness: it allows the entire dynamic port range rather than your chosen block. If you set a fixed passive range in IIS — and you should — prefer your own precise rule below and leave the predefined passive rule off.
2
Route Two — Precise Rules You Create Yourself
For the control port:
netsh advfirewall firewall add rule name="FTP Control Port 21" dir=in action=allow protocol=TCP localport=21
For your passive range, matching exactly what you set in FTP Firewall Support:
Apply the FTP service itself is not enough — some setups also enable the service rule via the predefined group; test after creating yours, and if the service executable needs its own program rule you will see it in the FTP log as connections that reach no banner at all.
3
Scope Every Rule to the Networks That Need It
An allow rule for Any address is a decision to serve the whole internet. For a LAN server, restrict the source:
netsh advfirewall firewall set rule name="FTP Control Port 21" new remoteip=192.168.1.0/24
Apply the same scoping to the passive rule. Branch offices get their subnet added; nobody else gets anything.
Scoping does not replace passwords or FTPS — it removes strangers from the conversation entirely, which is why the brute-force noise in your logs drops to near zero.
4
The Rules You Must Never Create
Never an inbound rule allowing all ports or the range 1-65535 "for FTP" — that is not a firewall rule, it is the firewall's resignation letter.
Never leave the firewall fully disabled after a test. If a test needs it off, the test lasts two minutes, the firewall goes back on, and the real rule gets fixed.
Never forward the passive range on the router to a different machine than the FTP server — a classic copy-paste error that exposes an innocent PC.
One more honest note: netsh advfirewall set global statefulftp enable can open data ports dynamically for plain FTP, but it reads the control channel to do it — with FTPS encryption it cannot, so fixed rules remain the professional default.
5
Verify the Rules Like an Outsider
From another LAN PC: Test-NetConnection 192.168.1.10 -Port 21 must succeed, and a real FileZilla upload must follow it.
From a network outside the allowed scope, the same test must fail. A scoping rule you have not watched refuse someone is unverified.
Change the IIS passive range later? Change this rule in the same sitting. The passive-mode page's whole lesson is that the three places must agree.
🔴 One rule before anything else: classic FTP sends the username, the password and every file in plain readable text. Inside a trusted office LAN it still has honest uses. On the open internet it does not — there the answer is FTPS or SFTP, and these pages will keep saying so.
🎥 Watch the Complete FTP Server Deployment
The video sets up the whole FTP server on Windows live — including the fast automated route — so you can follow it on your own server, click by click.
FTP works with the firewall off and fails with it on — which rule is missing
Test in order: port 21 first — if the client cannot even get the welcome banner, the control rule is the gap. If login works but transfers hang, it is the passive range rule. The symptom tells you the rule; the firewall never needs to stay off.
Is netsh deprecated — should I use PowerShell instead
Microsoft steers new work to the NetSecurity PowerShell cmdlets such as New-NetFirewallRule, and they do the same job. The netsh commands here still work across every supported Windows version, which is why admins keep them in the runbook.
Do I need outbound rules for the FTP server
For passive mode the server's data connections are inbound to the server, covered by your inbound rules. Default Windows outbound is allow, so standard FTP and FTPS deployments need no outbound rules at all.
This guide is based on the Technical Anshu video — Windows FTP Server Deployment Guide for IT Admins • Stuck on a step — ask in the video comments and you will get an answer there 🙏