Windows Server 2016端口21本地显示开放，在线检测关闭求助

Hey there, let's figure out why your FTP port 21 shows open locally when you run netstat -a, but external port checkers say it's closed. I've worked through this exact issue a bunch of times, so here are the key things to check and fix:

1. Check Windows Firewall Inbound Rules #

• The most common culprit here is Windows Server 2016's built-in firewall blocking external access to port 21.
  • Fire up the Firewall with Advanced Security by typing wf.msc into Command Prompt and hitting Enter.
  • Head to Inbound Rules and search for any existing FTP rules. Make sure the rule allowing TCP port 21 is enabled, and that it applies to the network profiles your server uses (like Public or Private).
  • If there's no rule for FTP port 21, create one:
    1. Click "New Rule" → Pick "Port" as the rule type.
    2. Choose TCP, enter 21 as the local port, then click Next.
    3. Select "Allow the connection", check the right network profiles, and name the rule something like "Allow FTP Port 21". Enable it once created.

2. Verify FTP Service Binding Address #

• Sometimes your FTP service is only listening on the local loopback address (127.0.0.1), which means only the server itself can reach it—external tools will never see it as open.
  • Run netstat -ano | findstr ":21" in Command Prompt. Look at the first column: if it says 127.0.0.1:21, that's the problem.
  • Open your FTP server's config (whether it's IIS FTP, FileZilla Server, or another tool):
    • Find the "Listen Address" or "Binding" setting and change it to 0.0.0.0 (to allow all incoming IPs) or your server's actual public/private IP.
    • Restart the FTP service after making this change.

3. Set Up Port Forwarding (If Your Server Is in a LAN) #

• If your server is behind a router (on a local network), you need to tell the router to send external traffic on port 21 to your server's internal IP.
  • Log into your router's admin panel (usually via a local IP like 192.168.0.1 or 192.168.1.1).
  • Look for "Port Forwarding" or "Virtual Server" in the settings.
  • Add a new rule:
    • External Port: 21
    • Internal Port: 21
    • Protocol: TCP
    • Internal IP: Your server's local LAN address (e.g., 192.168.1.50)
  • Save the rule, and double-check that your router's own firewall isn't blocking this forwarded port.

4. Rule Out Passive FTP Mode (For Later) #

• FTP has two modes: Active and Passive. Passive mode uses extra ports, but external checkers usually only test port 21. Focus on getting port 21 working first with Active mode, then you can configure passive ports if needed.

5. Test Connectivity Step-by-Step #

• LAN Test: Grab another device on the same network and try connecting to ftp://[your-server-lan-ip]:21. If this works, the issue is with your router or public network settings.
• External Test: If you have a public IP, try connecting from an external network (like a phone's hotspot) to ftp://[your-server-public-ip]:21. This will tell you if the problem is with the port checker or actual connectivity.

内容的提问来源于stack exchange，提问作者kshan 2k18