Sick FTP service

On Windows 2008R2 server, a freshly installed FTP service does not accept an external connection attempts, even if the FTP firewall rule is enabled.
Could be cured by issuing the following command:
netsh advfirewall set global StatefulFTP disable
Then restart of the ftpsvc service.

To change the network profile

If you wired two PC together using a crossover cable or a hub without an outbound connection, windows makes the network connection type (profile) "Public" and all the public firewall rules will be applied. It's possible to make it "Private" using the script as described in this blog.

ftp thru a NAT firewall

I always was wondering, how ftp data connection gets through a firewall with NAT.
A ftp client on a machine with local IP (192.168.x.x) sends its own local address, like:
---> PORT 192,168,0,2,150,117
but the server still manages to establish the data connection to the client machine.
The answer to this question is simple - the NAT router works also on the application level and understands the ftp commands. When it sees the "PORT" command in the control connection, it translates the internal address to the external and adds a temporary record to the firewall table.

It's funny, but my simple cheap WiFi all-in-one box at home does the job when the ftp commands are upper cased and ignores it when it lowercased.

Good article about the subject here: