Home › Topics › Active vs Passive FTP

Active vs Passive FTP

No single topic causes more FTP confusion — or more support tickets — than the difference between active and passive mode. The distinction is actually simple: it is entirely about who opens the data connection. But that one detail collides with firewalls, NAT, load balancers, and decades of default settings in ways that keep catching administrators out.

This series covers the two modes end to end. It includes the definitive explanation, the firewall story, and systematic troubleshooting. It also covers proper server-side passive configuration, the four commands on the wire, and the advanced case of FTP behind load balancers. Start with the first article if the modes have never quite clicked. Jump straight to the diagnosis or configuration guides if something is broken right now.

Articles in This Series

Active vs Passive FTP, Explained Until It Finally Sticks
The definitive plain-English explanation of FTP's two connections, who opens what in each mode, and why “switch it to passive” fixes so much.
Why Firewalls Block Active FTP (and What to Do About It)
Stateful firewalls, NAT, and connection helpers — why active mode's callback fails on modern networks, and the fixes that actually work.
Diagnosing FTP Mode Failures from Logs and Captures
The symptom patterns (hangs at LIST, 425/426 errors), how to read session logs and decode PASV replies, and three fully worked incidents.
Configuring Passive Port Ranges Properly on Your FTP Server
Sizing the range, choosing the numbers, announcing the right external IP behind NAT, matching firewall rules, and verifying from outside.
PORT, PASV, EPRT, and EPSV: FTP's Four Data-Connection Commands
What each command puts on the wire, decoding the six-number replies by hand, and how IPv6 changed the negotiation.
Running FTP Behind Load Balancers and Proxies Without Breaking It
Session affinity, passive-range strategies per backend, health checks that don't lie, and DMZ publishing patterns that survive real load.

Frequently Asked Questions

What is passive FTP mode?

In passive mode the client opens both connections: the control connection to port 21 and, for each transfer or listing, a data connection to a port the server announces in its 227 reply. Because the client initiates everything, passive mode works through client-side firewalls and NAT, which is why almost every client defaults to it today. The server must have a defined passive port range that its firewall allows.

Should I use active or passive FTP?

Passive, unless a specific legacy device forces active. Active mode requires the server to connect back to the client, which most client-side firewalls block; passive mode only requires the server administrator to open and announce a passive range. The series explains both modes, how to configure the range, and how to diagnose the failures each mode produces.

Explore More Topics

This series is part of the Sysax file transfer topic library. The library covers the protocols, security practices, automation techniques, and operational skills behind reliable file transfer. The library pairs well with the practical tools we build. Sysax Multi Server is a secure FTP, FTPS, SFTP, and HTTPS server for Windows. Sysax FTP Automation schedules and scripts secure transfers so the routine ones run themselves.