FTP by default utilizes active-mode, which can cause issues because of the way FTP works. The problem is generally with the client. When the first request is sent to the server, the client sends information containing the port that it wishes to use to receive the file from the server. This is done on port 21. The server responds back to the client over the port the client specified (not 21). The client firewall will see this as unsolicited and drop the connection.
Because of this, I'm assuming the FTP service you are connecting to resides on the same server.
Regardless, you have a few things you can do.
- enable firewall logging, you should be able to see the attempted connections being blocked and you could modify your rules accordingly.
If you cant get enough information from the logs:
- Use a tool to watch the traffic (Fiddler, NetMon, WireShark). Since you can recreate the situation, you can see what a good connection will look like, and what the bad ones look like. From here you can see where the issue is occurring ( request or response side). These captures will also assist in configuring your firewall.