# SBS2003 setting up IIS FTP problems!



## Sarekrn (Dec 23, 2011)

Hey guys, I have had this sbs 2003 server for a few years kicking around some client pc's at work for a long time. Recently I wanted to add an ftp server to it just to exchange files.I have been working on this all day and I am stuck.2 NICs. 1 x 192.168.1.103 -> goes to router -> Internet 1 x 192.168.0.100 -> local gateway nicFTP setup under IIS for 192.168.0.100RRAS "External NIC" has been configured for FTP Server on under ports, which is going to the local nic 192.168.0.100Router is configured to forward 20-5000 *just for tests* to 192.168.1.103Router is configured for a dynamic dns hostname, and the external nic has been configured as a static ip from the routerProblem: I cannot ftp to the hostname from out of the LAN. No issues at all inside, but not externally. I can ftp to the hostname from the server or any pc on the LAN. However I cannot ftp to the "EXTERNAL IP" .. I would think you could ftp 192.168.1.103 and it would forward your request on port 21 to 192.168.0.100 but it certainly is not.. I am thinking this is my problem but not sure how to solve it?? Any ideas?Regards,Dustin


----------



## Rockn (Jul 29, 2001)

The external IP you need to port forward to is the router's IP address, not any of the LAN private IP addresses.


----------



## Sarekrn (Dec 23, 2011)

When you say forward to the routers ip, are you talking about the FTP server setup in rras? Because if I right click my external network card config in rras and goto properties, click on services and ports then double click FTP server.. I was almost positive that this is supposed to be the local FTP address? If not where would I forward traffic from the external ip on port 21 to the internal ip?


----------



## Sarekrn (Dec 23, 2011)

This is driving me nuts lol.. It should be easy.. Ok follow up I set the ftp site to be ran on the external card (192.168.1.103) and I can ftp into the server from any PC on the LAN using the hostname or the IP address.. why oh why cant I ftp in from the outside my network? Any ideas?


----------



## leroys1000 (Aug 16, 2007)

You need to forward the router to the servers local IP.
Then,to access from the outside of the network,use the modems IP.
The modems IP is the incoming/outgoing connection from the internet.
The request will come into the modem and go to the router,which then
needs to forward it to the server.
You should be able to find your modem IP on the routers status page.
Some networks will not route a request properly onto the internet,to
and from the same network.
I used a proxy server call JAP to get around that when I ran into it.
http://anon.inf.tu-dresden.de/index_en.html
When using a proxy,the request appears to be coming from a different network.


----------



## Rockn (Jul 29, 2001)

Because 192.168.1.103 is a private IP address behind your firewall and or router. The public internet will never see that IP address so you need to get into your router or firewall and configure port forwarding from the WAN interface (public internet) to your LAN IP (private network) 192.168.1.103


----------



## Sarekrn (Dec 23, 2011)

Isnt that what I meant by saying Ive forwarded port 21 to 192.168.1.103? Or do I require to forward something else?


----------



## leroys1000 (Aug 16, 2007)

You just need to use your modem IP to access your
network from the internet.
Make sure you have the proper permissions setup
or anyone will be able to access it.
Dynamic IP's like from cable companies can change periodically.
If you are using a dynamic IP and you plan to keep the server
running,you would want to get a domain and use a service
like dydns or dnsexit to keep the IP updated to the domain.


----------



## Sarekrn (Dec 23, 2011)

Yep I am using dyndns.org but I have never ever heard the term "modem ip" could you elaborate I Didnt quite get what u were saying earlier


----------



## leroys1000 (Aug 16, 2007)

Your internet modem that you use to connect to the internet
through your internet service provider.
It has it's own IP assigned.
That is the one that you need to use to connect to the network
from the internet.
Check your router for a status page and it should show the
present modem IP in there.
You would need to use the format http://000.000.000.000:21
The zeros are whatever the IP is and the :21 tells your browser
to connect to port 21.
You should aslo be able to use ftp: in your browser instead of http:
You need to have a domain setup on your server in order for dydns to work properly.
If that is setup properly,then using the domain and port 21 should
put you onto your network for ftp.


----------



## Sarekrn (Dec 23, 2011)

Yeah my dyndns domain goes to the routers wan ip address.. This should forward traffic to the routers LAN ip of 192.168.1.1 which I have forwarded port 21 to 192.168.1.103.. I'm assuming this is correct?


----------



## Sarekrn (Dec 23, 2011)

Btw FTP://domain.dyndns.org doesn't goto my ftp


----------



## leroys1000 (Aug 16, 2007)

You actually need to buy a domain name and set it up
in both the domain control panel and on the server
in the DNS settings.
It needs to be directed to the dydns name servers in the domain control panel.
It can be a bit of a pain,but I have done it before as
I have run webservers from one of my home computers.
http://dyn.com/support/how-do-i-delegate-my-domain/

OOPs sorry,didn't see the previous post.
You are still trying to use a local IP,which is the router IP.
That wont work.
You have to use the IP that is assigned to your modem.


----------



## leroys1000 (Aug 16, 2007)

From your router IP,I am going to guess linksys router?
Log into the router,click status.
It should say internet IP and show the numbers.
That is the IP you want to use.


----------



## Sarekrn (Dec 23, 2011)

Merry Christmas!

Yes. doesnt the router naturally forward all internet traffic to the routers LAN ip of 192.168.1.1? and then you forward the port from 192.168.1.1 to your LAN pc 192.168.1.103?


----------



## Rockn (Jul 29, 2001)

No. You LAN IP address is not 192.168.1.1, that is a private IP address. FTP is not a port that is normally open on home based routers for a reason.


----------



## leroys1000 (Aug 16, 2007)

Yes,the router will forward on any ports that are opened,
but it can't forward anything that is not getting to the router.
All internet traffic connects to the modem first.
You ISP is automatically assigning an IP to the modem.
That changes periodically so you need dynamic dns.
Your modems IP is like your internet phone number.
You can't call your modem using the wrong number.

So data goes to your you modem first,is transfered to the routers wan port,
then is transfered out to the computers on the network.
That is why it is called a router.
It routes data to and from the appropriate computer,but the router itself
does not provide access to the internet unless it has an integrated modem.
It is the modems job to communicate with the internet,so you need to use
the modems IP to access it.


----------



## Sarekrn (Dec 23, 2011)

Yeah this is becoming a pain.. I cant find the modem's IP address anywhere.. I do know what your talking about now.. The IP of the DSL modem for eg.. but all I can see on my router webpage is the WAN ip of the router.. If I have to use the modem's IP to access my server what good is DYNDNS? Because you basically setup the dyndns in the router so that your domain will update with the dynamic address? I will see if I can find anything by logging into my account of my provider.. It just doesnt make sense, I thought all traffic that is directed to my routers WAN IP gets routed by the routing table in the router. Therefore if I route port 21 of my router WAN IP to the local 192.168.1.103 it should arrive at my server..


----------



## Sarekrn (Dec 23, 2011)

I just logged into my provider account and it shows my IP as the exact one on my router..


----------



## Rockn (Jul 29, 2001)

What is the make and model of your router? Maybe you could take a screenshot of the configuration pages you set for port forwarding.


----------



## leroys1000 (Aug 16, 2007)

What exactly are you using to connect to the internet?
You have to have some kind of modem.
Did you log into the router setup and check the status page?
Are you on some kind of direct connection,like a T1 line?
Or are you on cable or DSL internet?
DYNDNS,when properly configured,changes the IP info for the domain
so requests will always be routed to the modem.
In any case,whether it is built into the router or is a seperate device,
there has to be some sort of hardware modem device that connects to
the internet.


----------



## Sarekrn (Dec 23, 2011)

I would think that the router would at least log traffic coming in on port 21, but I am getting absolutely nothing.. Is there a way I can at least find out where my routing issue is?


----------



## Sarekrn (Dec 23, 2011)

I am on a DSL connection configured as such: DSL modem (IP: 206.xxx.xxx.xxx) according to my ISP which goes to my linksys router which has the same IP 206.xxx.xxx.xxx which is routed via uPnP as on the attched screenshot. Obviously my most important forwards are port 21 and port 80.. Neither of which I can access from an outside network.


----------



## leroys1000 (Aug 16, 2007)

Without sending data to your modem,there isn't anything coming in to log.
You seem to be avoiding finding the modem IP.
Please answer the questions above.
Please login into the router and check the status page for the modem IP.
If you don't know how to do that,post the router model number and
we will find the appropriate instructions.

Sorry,you beat me too it.


----------



## leroys1000 (Aug 16, 2007)

OK so the 206 IP is probably your modem.
Use that IP for your incoming connection and DYNDNS.
You should be able to test the connection by typing
http://206.XXX.XXX.Xxx
You may need to add :21 to the address to test.
That makes it specifically go to port 21.
whatever the IP is in your web browser.
Forwarding is to forward the data coming in to the server.
That would be the local computer IP.
So it goes modem to router,router forwards to computer IP.


----------



## Sarekrn (Dec 23, 2011)

Status page attached


----------



## Sarekrn (Dec 23, 2011)

yep exactly.. and I have been doing that, and I get nowhere .. it will not goto my webserver on port 80 and it will not goto my ftp server on 21.. On the LAN I can type in the dyndns all day and it will goto the appropriate server.. My issue is outside the LAN


----------



## leroys1000 (Aug 16, 2007)

Make sure you have a firewall running on your server.
Make sure port 21 is open in the firewall.
Should be by default.
Go to DMZ on your router and enter the local IP of the server and enable.
Save the settings.
That will open all ports to that IP.
Open internet explorer and type http://206.xxx.xxx.xxx:21<<<your modem IP
and see if it connects.
Remember to use the modem IP to connect,the local will never work.
If you are trying to connect using the modem IP and doing it
from your local network,it may not work.
Some routers don't allow that.
You would need to proxy out to the internet so it looks like a different network.

Also,have you setup DNS on your server?
Looks like you have block WAN requests enabled on the router.
That is going to block your incoming traffic.


----------



## Sarekrn (Dec 23, 2011)

Yes, Ive done it, and I cant get anywhere.. Here is the issue.. I am running RRAS because of my 2 NIC enviornment, and Im not quite sure how to route ftp traffic through rras.. Do you have experience with it?


----------



## Sarekrn (Dec 23, 2011)

btw block WAN requests is auto disabled when DMZ is active.. And yes using the modem IP locally works, but if I try to connect from my iphone 3g network I cannot connect to either ftp or web server


----------



## leroys1000 (Aug 16, 2007)

Did you turn off that block WAN requests so your traffic can get through the router?
Not really familiar with setting up the virtual network on RRAS and bridging the adapters.
Some info here.
http://shannonbray.wordpress.com/2010/05/25/configuring-rras-for-windows-server-2008-r2/


----------



## leroys1000 (Aug 16, 2007)

Ok hang on and let me get your IP from you sceen shot
and try it.


----------



## leroys1000 (Aug 16, 2007)

Can't do that,you marked out the last 3.
Can you PM it to me so I can try from here?


----------



## Rockn (Jul 29, 2001)

Check with your ISP to see if they are blocking FTP port 21


----------



## Sarekrn (Dec 23, 2011)

There has got to be some way of finding where the ftp traffic is being halted. Like is the router the issue or is it the actual forwarding in the server.. And if so, I must be able to figure out what is happening with the internal server routing with a log of some sort


----------



## Rockn (Jul 29, 2001)

If all of the other services that you are forwarding work then it is being blocked by the ISP. It is not even hitting your router or responding via telnet.


----------



## leroys1000 (Aug 16, 2007)

If the modem IP is going out locally and coming back in,
Then it is working.
It may be that your 3G network is blocking it.
If you want to PM me your modem IP,I'll check it for you.
If not,I understand.
I'm not a hacker or anything and I'll just delete it after.


----------



## Sarekrn (Dec 23, 2011)

rockn: Its not an isp issue as I cannot even get onto the webserver on port 80...


----------



## Rockn (Jul 29, 2001)

They are probably blocking port 80 as well. If this is not a business class account they can be blocking pretty much anything. I purchased a business class account with a static IP address and they were blocking SMTP by default.


----------



## leroys1000 (Aug 16, 2007)

PM deleted.
I tried 80 and 21 and nothing.
Looks like your ISP is blocking server requests.
Might check with them.
DMZ settings should have put me straight onto your server.
You did use the 103 local IP that is assigned to the computer in the DMZ right?
Tried ftp protocol too,nothing.


----------



## Sarekrn (Dec 23, 2011)

FAN****ING TASTIC! I love you guys! Thank you very much leroys and rockn I had an epiphany when rockn said that they are probably blocking 80 as well.. Gave the isp a call and indeed 21 and 80 are blocked ports. I will be upgrading to a static ip as of tomorrow.. Thank you so much guys!


----------



## Rockn (Jul 29, 2001)

De nada!


----------



## leroys1000 (Aug 16, 2007)

Well,we tried.
Sorry you have to go to the extra expense of a static IP.
At least you wont have to use dynamic dns.
I use Cable One and they don't block much of anything.
Probably because they are not a massive ISP.


----------

