IIS 7.5 FTP Port Range

With the new version of IIS 7.5; which is included with Windows 2008 R2; the FTP service (new and improved of course) in IIS 7.5, allows for the use of SSL Certificates and SFTP, it also allows the use of the Windows TCP/IP stacks Random port range and a separate customizable range for the FTP Service. Read on to learn how to customize these ranges to allow specific firewall port ranges.

When the firewall is disabled in Windows 2008 the custom port range in IIS 7.5 FTP Service does not is grayed out. Meaning that it is relying on the 2008 TCP/IP stack which is defaulted to be from 49152 to 65535, which is way too wide to open to the outside world. The good news is that this range can be changed and alerted to fit your needs. Here are the commands from Microsoft to do this (of course FTP is only TCP):


netsh int ipv4 set dynamicport tcp start=10000 num=1000
netsh int ipv4 set dynamicport udp start=10000 num=1000
netsh int ipv6 set dynamicport tcp start=10000 num=1000
netsh int ipv4 set dynamicport udp start=10000 num=1000


The KB article is here.