IIS 7.0 FTP Configure the Data Channel Port Range

When you use a firewall in your network you can limit the range of dynamic ports (also known as ephemeral ports) that can be used for passive connections in FTP. When a client issues a PASV command, the FTP server responds with a dynamic port to be used as the server-side port of the data connection. The default port range is configured in Windows TCP/IP settings.

备注

The dynamic port range in earlier versions of Windows was 1025-5000. This was changed in Windows Vista and Windows Server 2008 to comply with Internet Assigned Numbers Authority (IANA) recommendations about using ports. If you deploy Windows Vista or Windows Server 2008 in your network, and you use firewalls to restrict traffic on your internal network, you must update those firewalls with the new port range. For more information, see "The default dynamic port range for TCP/IP has changed in Windows Vista and in Windows Server 2008" on the Microsoft Help and Support site. 新的默认起始端口 49152，且默认结束端口为 65535

You should configure your firewall to accept traffic over a smaller range of ports. Then configure the Data Channel Port Range for the FTP server so only that range of ports is used for passive connections.

To configure the data channel port range

1. Open IIS 管理器.

2. In the Connections pane, select the server node.

3. In Features View, double-click FTP Firewall Support.

4. In the Data Channel Port Range box, type a range of port numbers (separated by a hyphen). For example, type 5000-6000. Or type 0-0 to use the default port range specified in Windows TCP/IP settings.

   备注
   Do not use ports 0-1024 because these are reserved ports.

5. In the Actions pane, click Apply.