Google Compute Engine FTP Firewall

Question

I have the FTP working properly on the localhost on a Google Compute Engine. I added a firewall rule to allow port 21 but I still cannot connect from the world to FTP.

Any ideas?

Answer 1

FTP is a complex protocol which uses multiple TCP connections, a feature which is always causing trouble. Port 21 is only used for the command channel but the data transfer itself is done using a new TCP connection where the necessary endpoints (i.e. port numbers) gets dynamically allocated and communicated inside the command channel.

This behavior makes it impossible to use securely with simple firewalls, i.e. you would need to have a wide range of ports open all the time. More intelligent firewalls provide helpers which watch the command connection and dynamically open ports. But even these loose if you use encryption, i.e. FTP with TLS (FTPS), because they can no longer inspect the command connection.

Thus if there is a direct connection between client and server without any firewalls in between FTP works usually fine. If one side is behind a firewall or NAT (like most home users) you might have success after playing around with active or passive FTP mode. But if both sides are behind a firewall or NAT then the you have usually lost.

Instead of using FTP I would recommend to use SFTP. This protocol is based on SSH and uses only a single TCP connection. It can thus easily be configured with firewalls. Apart from that it is more secure, i.e. everything is encrypted by default. Lots of clients like FileZilla or WinSCP support it.

Answer 2

You can use SSH to transfer files to your Linux Instance. If you can establish an SSH connection to an instance using the SSH from the Browser window, you can use that connection to transfer files to the instance.

1. In the GCP Console, go to the VM Instances page.

2. In the list of virtual machine instances, click SSH in the row of the instance that you want to connect to.

3. After the connection is established, click the gear icon in the top right of the SSH from the Browser window and select Upload File. Alternatively, select Download File to download a file from the instance.

4. The transfer dialogue window opens. Specify which file you want to transfer.

If you uploaded a file, the file is in your user's /home directory. If you downloaded a file, the file is in the default download folder on your local workstation.

You can also use SCP to transfer files on Linux. To learn more about transferring files to instance, please visit this documentation