19 Nov

Setup FTP Server Secure on Azure Windows

in Azure

To setup an FTP server in Azure, the easiest and quickest way is to install our FTP Server solution from the Azure marketplace. The image comes pre configured using Filezilla FTP Server running on Windows server. It will allow you to securely transfer files using encryption over FTPS / SSL. Click on our links below to deploy to your Azure tenant

FTP Server Azure

Setup FTP Server on Azure on Windows 2019

Deploy Windows Server 2019 running Filezilla FTP Server

Setup FTP Server on Azure on Windows 2016

Deploy Windows Server 2016 running Filezilla FTP Server

Also Check Out

Our other FTP Server solution that integrates with Azure File Share

Getting Started with Azure FTP Server

Once your Azure VM has been deployed there are some post configuration steps to complete to start using this FTP Server.

Login

Launch Filezilla Server Instance App

Launch the Filezilla server instance app, found on the desktop. On the launch screen press connect as shown below (password is blank):

Azure FTP Server - Passive Mode on

You should now be connected. You may see connection errors and NAT errors, this is normal as we need to complete some configuration. From the menu select

Edit > Settings > Passive Mode Settings

You’ll need to set a passive mode port range. Usually (50000-51000). These ports are used for data transfers to the server.

Set Public IP Address

For this next part you’ll need to make sure the VM has a public IP address to allow external clients to connect as shown in yellow.

To attach a public IP address to your VM, follow Microsoft’s guide

Once you have a public IP address associated with the NIC on your azure VM, add the IP address to the passive mode settings as shown below highlighted in yellow and also the passive port range:

Create Certificate (FTP over TLS)

The next step is to create a new private key and a self signed certificate, needed by FileZilla server to accept TLS connections.

Within the FileZilla server options, click on SSL/TLS settings. Check the Enable FTP over TLS support (FTPS).

Next click on Generate New Certificate > Fill in your company information.

IMPORTANT – In the common name (Server address) field make sure to add the public DNS name of your Azure VM. This can be found in the azure portal, as highlighted in yellow:

Save the key locally on the server and then press Generate certificate. No need to add a password.

Setup FTP Server Users

There are 2 options:

Create local users and assign access.

2. Integrate Active Directory and allow users to use their AD domain logins to authenticate

Also Read

How to Setup Active Directory Domain on Azure

Option 1 - Create Local FTP Users

To setup local users and give access to directories locally on your server navigate to Edit > Users

Here you can add users and generate their passwords.

Then give the users access to your local folders you would like them to have access to.

The VM has a pre-configured folder on the C:\FTPDirectory that can be used or you can setup as many folders as you like.

Groups can also be setup and permissions applied at a group level.

Option 2 - Use Active Directory Integrated Users

Open settings > LDAP and select enable LDAP support. Beta.

Add your private IP address of your local domain controller. Add Port 389 and write the name of your domain name.

Select Enable TLS/SSL.

Next you need to add the users who need access to your FTP directories.

Select Edit > Users and here you’ll need to add the users full UPN that they use to logon to AD, for example if their name is jsmith@yourdomain.com or yourdomain\jsmith we need to make sure we add this so it matches their login UPN jsmith@yourdomain.com. We don’t need to add their password here as it authenticates against Active Directory, so make sure the password checkbox is unchecked.

Next check the boxes LOCAL and LDAP as in the screenshot below.

In the screenshot below I’ve added a test user from our AD called ftpuser and our AD domain is called yourdomain.com

Next is to assign these users to your FTP directories they need access to. Click on Shared Folders within the Users menu and add the local folders and assign permissions they need:

Now would be a good time to test if you can connect using an FTP client. If you can’t connect, try the next step and to configure any NSG / Firewall rules.

Azure FTP Server Firewall Ports

If you have NSG’s or firewall appliances in Azure you will need to open access to the following ports:

Port: 21 (Used for FTP)

Port: 990 (Used for FTPS)

Port: 14147 (Used for FTP Server Administration)

Passive Port Range: 50000 – 51000 (Used for data transfer)

To setup Azure firewall rules refer to – Azure Network Security Groups

FTP Client Software

To allow clients to connect, users can use any FTP client. You can use FileZillas FTP Client

FTP Server Support

For issues regarding setup of this solution, leave a message in the comments below or contact us directly for assistance.

Disclaimer: This FTP server solution is built using a modified version of Filezilla server opensource software. This solution is provided under GPLv2 licence. The respective trademarks mentioned in the offering are owned by the respective companies. No warrantee of any kind, express or implied, is included with this software
– Use at your risk, responsibility for damages (if any) to anyone resulting from the use of this software rest entirely with the user
– The author is not responsible for any damage that its use could cause.

Common Questions

Q: I receive the following error when connecting via my FTP client ‘425 Can’t open data connection.’

A: The passive port range (50,000 – 51,000) is being blocked by your firewall. Typically its usually not setup on your Azure Network Security Group (NSG).

Within the Azure portal, if you open the VM properties and under ‘Networking’ you should see ‘Network Security Groups’

The following guide explains how to edit the rules

https://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal

Add a new rule to allow port ’50,000 – 51,000’ over TCP to Allow Source ‘Any’ Destination ‘Any’

Once you’ve added the rule, reboot the VM and it should now work

5 2 votes

Article Rating

19 Comments

Most Voted

Newest Oldest

Inline Feedbacks

View all comments

Evgeniy

Guest

3 years ago

Do not forget about windows firewall, need to open ports or disable it.

Andrew Fitzgerald

Author

Reply to Evgeniy

Thanks for your comment Evgeniy, This FTP Azure marketplace image comes pre-configured with the required Windows firewall ports enabled and NSG firewall ports so there’s no need to perform this step

Tod Richard

What would the monthly cost be for this setup?

Reply to Tod Richard

Hi Tod,

It would depend on the size of the VM you choose. To get an estimate of costs have a look at the pricing on the following link:
https://azuremarketplace.microsoft.com/en-us/marketplace/apps/cloud-infrastructure-services.filezilla-ftp-server?tab=PlansAndPrice

Sidney Mulder

I followed the instructions as discribed above. My client does connect but fails to retreive the directory listing. Any idea what is happening?

Reply to Sidney Mulder

Hi Sidney,

Are there any errors within the FTP Client ?

Have you specified a shared folder and given the user access this folder within Filezilla Server, under users?

Have you also applied the firewall rules to any firewalls / Network security groups you have configured ?

Reply to Andrew Fitzgerald

Hi Andrew,

I’m now using the FileZilla Client. This client puts out this output:
(000005)7/26/2018 11:47:16 AM – daxtimetell-test (x.x.x.x)> PASV
(000005)7/26/2018 11:47:16 AM – daxtimetell-test (x.x.x.x)> 227 Entering Passive Mode (y,y,y,y.195,84)
(000005)7/26/2018 11:47:16 AM – daxtimetell-test (x.x.x.x)> MLSD
(000005)7/26/2018 11:47:26 AM – daxtimetell-test (x.x.x.x)> 425 Can’t open data connection.

I have created a subfolder in C:\FTPDirectory called FTPUser and set only that folder in the shared folders of that particular ftpuser. I gave it all available permissions.

I added the passive portrange 50000-51000 to the firewall of the Network Security Group that came with de deployed FTP Server. No extra Firewall is added yet. Also disabled the firewall within Windows Server 2016, just to be sure.

I hope you can help me further.

Best regards,
Sidney

Hello Andrew,

I figured out what the problem was. A faulty NSG rule I configured for the passive ftp ports caused this problem. Thanks for you help.

Sidney

Are you connecting to the FTP server externally via public IP or internally via your LAN on private IP?

Is there a company firewall or router that your going through in order to connect to the FTP server ?

It sounds like there is a network device in between your connection

There is a thread of Filezilla forum with someone else who had the same issue and how they resolved it:
https://forum.filezilla-project.org/viewtopic.php?t=34901

There is a guide on Filezilla on network setup, have a read of the following and let me know if that solves your issue – https://wiki.filezilla-project.org/Network_Configuration

Thanks
Andrew

Rick Nice

Does the version of FileZilla server you supply support UNC file paths?

Thanks

Rick

Reply to Rick Nice

HI Rick,

Can you elaborate abit more on what your trying to achieve ?

Keith

I followed these instructions, created local users and tested from a remote Filezilla client.

The client can connect to the server…, and I see that the server is sending the welcome message, but the client never receives the message.

Server:
(000034)8/21/2018 1:42:51 AM – (not logged in) (XX.XX.XX.XX)> Connected, sending welcome message…
(000034)8/21/2018 1:42:51 AM – (not logged in) (XX.XX.XX.XX)> 220-FileZilla Server version 0.9.41 beta LDAP
(000034)8/21/2018 1:42:51 AM – (not logged in) (XX.XX.XX.XX)> 220-written by Tim Kosse (Tim.Kosse@gmx.de)
(000034)8/21/2018 1:42:51 AM – (not logged in) (XX.XX.XX.XX)> 220 Please visit https://cloudinfrastructureservices.co.uk
(000034)8/21/2018 1:43:11 AM – (not logged in) (XX.XX.XX.XX> disconnected.

Client:
Status: Connecting to XX.XX.XX.X:990…
Status: Connection established, waiting for welcome message…
Error: Connection timed out after 20 seconds of inactivity
Error: Could not connect to server

Any ideas?

Reply to Keith

Hi Keith,

Sounds like a firewall is blocking one of the ports, have you checked you have allowed access via any network security groups you have configured on the VM ?

Greg Booth

Hi
Is this an SAS or IAS offering ?
Will the FileZilla software patch itself ?
Will we get a login for the virtual sedrver and need to login to the desktop ?
Regards
Greg

Reply to Greg Booth

Hi Greg,

This is an IaaS offering. It will install a VM in your Azure tenant. Yes the VM will patch itself. Yes during the provisioning of the server you will be able to decide on the username and password that you will use to login to the server. You can then login to the server and create user accounts that can be used to connect to the FTP server via your FTP client on your desktop.

Hope that helps
Andrew

Angelo Punturiero

Hello,
if an anterprise user has to send file from his local pc is possible to enable it to mount the directory remotely?

Or, alternatively is possible to use a local filezilla client to point to remote filezilla server?

These question in order to avoid large file copy on the Ftp_Vm .

Thanks in advance,

Reply to Angelo Punturiero

Hi Angelo,

If you want to mount the remote directory and to avoid the large file limit, have a look at our Azure SFTP Server which will allow your users to map a network drive to the SFTP server and upload files

Bjorn HOve

2 years ago

Hi
I installed Secure FTP Server on Azure Server 2016 from Marketplace in Azure. Installation went well and I have logged in to the server. There is no sign of Filezilla. I can see the freeFTPdservice running, but the documentation says nothing about freeFTP. The SFTP Server link on your homepage is broken also.
Am I missing something?

Reply to Bjorn HOve

Hi Bjorn,

Sounds like you’ve downloaded our SFTP Solution, thanks for letting me know about the link, i’ve updated it now. If you try the following link it has our SFTP documentation