Knowledgebase

 

 

Overview

Use either the active or passive mode to connect to a File Transfer Protocol (FTP) server.

 

Enable the passive port range for Pure-FTPd

To enable the passive port range on a server that uses Pure-FTPd, perform the following steps via the command line as the root user:

1. With a text editor, open the /etc/pure-ftpd.conf configuration file.

2. Remove the comment (#) from the beginning of the line that contains the PassivePortRange option.

3. Set the PassivePortRange option to a port range that is greater than or equal to 1024.

   In the following example, 30000 50000 represents the PassivePortRange option:

   PassivePortRange 30000 50000

   Important:

   We strongly recommend that you configure a large port range so that the server can process many simultaneous passive connections. For example, the Internet Assigned Numbers Authority (IANA) recommends the 49152:65534 port range.

4. If your FTP server exists behind a NAT configuration, set the ForcePassiveIP option to the FTP server's public IP address.

   In the following example, 10.3.5.333 represents your FTP server's public IP address:

   ForcePassiveIP 10.3.5.333

   Warning:

   We strongly recommend that you only use this option if your server exists behind a NAT configuration. This option prevents connections to other IP addresses on the server, and connections via domains that resolve to other IP addresses. If you set an IP address for theForcePassiveIP option, you can only connect to the FTP server via that IP address.

5. Save the changes to the configuration file.

6. Run the following commands to allow connections through the passive port range of your server's firewall:

   1 2	iptables -I INPUT 2 -p tcp --dport 30000:50000 -j ACCEPT service iptables save

   Important:

   If your FTP server exists on a CentOS 7, CloudLinux™ 7, or Red Hat® Enterprise Linux (RHEL) 7 server, run the following commands to allow connections through the passive port range that you set:

   1 2 3

   firewall-cmd --permanent --zone=public --add-service=ftp firewall-cmd --permanent --add-port=30000-50000/tcp firewall-cmd --reload

7. Run the /usr/local/cpanel/scripts/restartsrv_ftpserver command to restart the FTP server.

8. To make these changes permanent, you must append the passive ports to the configuration file. To do this, run the following commands as the rootuser:

   1 2	echo "PassivePortRange: 30000 50000" >> /var/cpanel/conf/pureftpd/main /usr/local/cpanel/scripts/setupftpserver pure-ftpd --force

9. If your FTP server exists behind a NAT configuration, run the following command:

   echo "ForcePassiveIP: 10.3.5.333" >> /var/cpanel/conf/pureftpd/main

   Note:

   10.3.5.333 represents your FTP server's public IP address.

For more information about how to edit your Pure-FTPd configuration, read our FTP FAQ documentation.

Enable the passive port range for ProFTPd

To enable the passive port range on a server that uses ProFTPd, perform the following steps via the command line as the root user:

1. With a text editor, open the /etc/proftpd.conf configuration file.

2. Add the following line to the first section of the configuration file, where 30000 50000 represents the PassivePorts option::

   PassivePorts 30000 50000

3. If your FTP server exists behind a NAT configuration, add the following additional lines to the configuration file:

   1 2	MasqueradeAddress example.com MasqueradeAddress 10.3.5.333

   Notes:

   • The MasqueradeAddress lines specify the FTP server's public IP address.
   • example.com represents your FTP server's hostname.
   • 10.3.5.333 represents your FTP server's public IP address.
4. Save the changes to the configuration file.

5. Run the following commands to allow connections through the passive port range of your server's firewall:

   1 2	iptables -I INPUT 2 -p tcp --dport 30000:50000 -j ACCEPT service iptables save

   Important:

   If your FTP server exists on a CentOS 7, CloudLinux 7, or RHEL 7 server, run the following commands to allow connections through the passive port range that you set:

   1 2 3

   firewall-cmd --permanent --zone=public --add-service=ftp firewall-cmd --permanent --add-port=30000-50000/tcp firewall-cmd --reload

6. Run the /usr/local/cpanel/scripts/restartsrv_ftpserver command to restart the FTP server.

7. System updates may overwrite these configuration changes. To make these changes permanent, you must append the passive ports to the configuration file. To do this, run the following commands as the root user:

   1 2	echo "PassivePorts: 30000 50000" >> /var/cpanel/conf/proftpd/main /usr/local/cpanel/scripts/setupftpserver proftpd --force

For more information about how to edit your Pro-FTPd configuration, read our FTP FAQ documentation.

SolusVM and Xen

If you use SolusVM and Xen on a CloudLinux™ server, you may experience problems with passive FTP. These problems may resemble a firewall or other connection issue, even when no firewall exists.

To resolve these issues, perform the following steps:

1. Replace the IPTABLES_MODULES=ip_conntrack_netbios_ns line in the /etc/sysconfig/iptables-config file on the VPS node with the following line:

   IPTABLES_MODULES=ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp ipt_owner ipt_REDIRECT

2. Run the service iptables restart command to restart the iptables service.