How do you configure the set of port to use for FTP passive data connection

Question

I was able to start the ftp server xml db and connect to it locally. When I tried to connect to it from home, I was able to log in but when i do a "get" command the sessions hangs. I also tried passive mode and do a "get" command and it gives me a connection refused error. I am using the default port 2100. I think this might be a firewall issue with the data connection port. I am not sure which range of ports to open for the passive ftp connection on the server side or where to go and set them for for the ftp server to use? Or this issue might not be firewall related??? Any thoughts. Thanks.

Answer 1

This is a typical problem with VPN/Firewall software and FTP on ports other than 21.
When you open the FTP data connection the FTP Server identifies which port the data will be sent on using the PORT command which is sent on the command port (typically 21 with a normal FTP server, 2100 by default with XDB). THe client then opens that PORT to accept the data (file, output of an ls etc).
As I understand it most VPN/Firewall are configured to monitor 21 for 'PORT' requests. They then understand to allow connection on the PORT number passed on the command PORT. Hence with Port 21 firewall / VPN software is not a problem. However since the XDB command PORT is something other than 21 they do not see / honour the PORT commands from the server and hence the client cannot open the data connection on the specified PORT
As to how to solve it, I wish I knew (After 5 years I still can't use XDB FTP from home to a machine in the office once the VPN tunnel is open :( ). I'm sure it's going to be firewall / VPN software specific and may need the VPN servers to be configured.
The best bet would be to run the FTP server on 21...
Add the following line to your listener.ora file
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP) (HOST = hostname) (PORT = 21))
(PROTOCOL_STACK = (PRESENTATION = FTP) (SESSION = RAW)))
and then restart the listener as root
Start the listener as root.
At the operating system prompt, enter tnslsnr with optional command line arguments. The usage is as follows:
tnslsnr [listener_name] [-user user] [-group group]
where:
Table 4-3 tnslsnr Utility Options
Option Description
listener_name
Specify the name of the listener. If omitted, the default name LISTENER will be used.
-user user
Specify the user whose privileges the listener will use when super user (root) privileges are not needed. After performing the privileged operations, the listener will give up root privileges irreversibly.
-group group
Specify the group whose privileges the listener will use when super user (root) group privileges are not needed. After performing the privileged operations, the listener will give up root group privileges irreversibly.
The listener will temporarily switch to the provided user and group immediately after startup. All subsequent operations will be done with the specified user and group privileges, except the system calls necessary to listen on configured endpoints. The listener will revert to super user (root) for a short period of time to listen on reserved addresses, such as TCP ports less than 1024. After the listener starts listening on all of its endpoints configured in listener.ora, it will switch to the specified user and group irreversibly. Therefore, the listener will give up the root privilege that it initially had. In the current release, -user and -group command line arguments only accept user and group identifiers specified in numeric form.
For example, to execute a root listener called mylsnr and have it use privileges of a user identified