AWS EC2 Windows服务器FTP上传失败：无法建立数据连接超时求助

Hey there, that timeout error is super common when moving FTP scripts to AWS—let’s break down why it’s happening and how to fix it.

The Root Cause: Active vs Passive FTP #

Your local machine probably uses active FTP without issues, but AWS EC2’s security rules block this by default:

• Active FTP: The FTP server tries to send data back to your EC2 instance on a random high port. AWS security groups don’t allow unsolicited incoming connections, so this times out.
• Passive FTP: Your EC2 instance initiates both the control and data connections to the server. This plays nice with AWS’s security setup since outgoing connections are usually allowed.

Step 1: Update Your Batch Script to Use Passive Mode #

The Windows built-in ftp.exe doesn’t have a dedicated passive mode command, but we can send the PASV command directly to the server using quote. Add this line to your ftp.txt commands right after binary:

@echo open URL>>ftp.txt
@echo USERNAME>>ftp.txt
@echo PASSWORD>>ftp.txt
@echo binary>>ftp.txt
@echo quote PASV>>ftp.txt  // This enables passive mode
@echo put TOOL_%date:~-2%%date:~-7,2%%date:~-10,2%.zip "/downloads/Tool%.zip">>ftp.txt
@echo quit>>ftp.txt  // Always close the FTP session cleanly

Then run the FTP command as usual:

ftp -s:ftp.txt

Step 2: Double-Check AWS Security Group Rules #

Even with passive mode, make sure your EC2 security group allows outgoing traffic on:

• Port 21 (the FTP control channel)
• The passive data port range your FTP server uses (most servers use 49152-65535, but confirm with your server admin if unsure)

Step 3: Verify Network ACLs (If Used) #

If you’re using AWS Network ACLs in addition to security groups, ensure they permit:

• Outbound traffic on port 21 and the passive data port range
• Inbound traffic on the ephemeral ports your EC2 instance uses for outgoing connections (though passive mode reduces this need)

Quick Test to Confirm #

If you want to be sure it’s a mode issue, install a GUI FTP client like FileZilla on your EC2 instance. Try connecting with active mode (it should fail) then switch to passive mode (it should work). That confirms the fix will work for your script.

Other Things to Check #

• FTP Server Settings: Make sure your FTP server is configured to allow passive mode and that the data port range is correctly opened.
• Windows Firewall: Temporarily disable the Windows Firewall on your EC2 instance to rule out local blocking. If it works, add exceptions for FTP traffic.

内容的提问来源于stack exchange，提问作者Hendouz