# How to Enable FTP Passive Mode

https://www.hostcarts.qa/knowledgebase/article/how-to-enable-ftp-passive-mode

## Overview

This document explains how to use the active or passive mode to connect to a File Transfer Protocol (FTP) server.

Important:

In cPanel & WHM version 60 and later, the system enables passive ports `49152` through `65534` for Pure-FTPd servers and ProFTPD servers by default. If you use the CSF firewall plugin, the system **also** adds passive port ranges to your server’s firewall by default.

If you use the `nftables`, `firewalld`, or `iptables` applications for your firewall, you **must** [enable firewall settings](https://docs.cpanel.net/knowledge-base/ftp/how-to-enable-ftp-passive-mode/#configure-the-firewall) for the passive ports manually. For more information about firewalls, read our [How to Configure Your Firewall for cPanel & WHM Services](https://docs.cpanel.net/knowledge-base/general-systems-administration/how-to-configure-your-firewall-for-cpanel-services) documentation.

## Active and passive mode sessions

FTP uses a data port and a command port to transfer information between a client and a server. During a typical active mode session, the command port uses port `21` and the data port uses port `20`. When you use a passive mode session, however, the data port does not always use port `20`.

### Active

In active mode, the FTP server responds to the connection attempt and returns a connection request from a different port to the FTP client. [Network Address Translation (NAT)](https://en.wikipedia.org/wiki/Network_address_translation) configurations block this connection request.

![*Active FTP*](https://docs.cpanel.net/img/activeftp.png)

![*Active FTP (with firewall)*](https://docs.cpanel.net/img/activeftpfirewall.png)

The firewall blocks the server’s attempt to communicate with the client because the server uses a different port than the first connection.

### Passive

In passive mode, the FTP client initiates **both** connection attempts. NAT configurations **do not** block this connection request.

![*Passive FTP (with firewall)*](https://docs.cpanel.net/img/passiveftp.png)

The firewall does **not** block the server’s attempt to communicate with the client because the client initiated the communication both times.

Note:

If FTP users exist on the private network side of a NAT configuration, you **must** enable FTP’s passive mode, and open the passive port range in your FTP server’s configuration file. You may also need to open the passive port range on your firewall.

## Configure FTP servers

The sections below explain how to edit the default configurations for a [Pure-FTPd](https://www.pureftpd.org/project/pure-ftpd/) server and a [ProFTPD](http://www.proftpd.org/) server.

Note:

- A local file contains your desired settings which **overwrite** any default settings from the main file.
- The system enables passive ports `49152` through `65534` for Pure-FTPd servers and ProFTPD servers by default.

### Pure-FTPd servers

To edit the FTP configuration for a PureFTP server, perform the following steps:

1. Log in to the server as the `root` user via SSH.
2. Open the `/var/cpanel/conf/pureftpd/local` file, if it already exists, with a text editor. If it does not already exist, create the `/var/cpanel/conf/pureftpd/local` file.
3. Add the desired changes to the file. If your FTP server exists behind a NAT configuration, set the `ForcePassiveIP` option to the FTP server’s public IP address, as in the following example: `ForcePassiveIP: 203.0.113.0` If your server does not exist in a NAT configuration, set the `ForcePassiveIP` option to the following entry: `ForcePassiveIP: ~` Important: Only one `ForcePassiveIP` entry can exist in a configuration file.
4. If you want to change your server’s default passive port range, run the following commands: `1 2` `echo "PassivePortRange: 49152 65534" >> /var/cpanel/conf/pureftpd/local /usr/local/cpanel/scripts/setupftpserver pure-ftpd --force`
5. Configure your server to allow the passive port range to pass through the firewall. To do this, follow the directions in the [Configure the firewall](https://docs.cpanel.net/knowledge-base/ftp/how-to-enable-ftp-passive-mode/#configure-the-firewall) section below.
6. Restart the PureFTP service with the following command: `/usr/local/cpanel/scripts/setupftpserver pure-ftpd --force`

### ProFTPD servers

To edit the FTP configuration for a ProFTPD server, perform the following steps:

1. Log in to the server as the `root` user via SSH.
2. Open the `/var/cpanel/conf/proftpd/local` file, if it already exists, with a text editor. If it does not already exist, create the `/var/cpanel/conf/proftpd/local` file.
3. Add the desired changes to the file. If your FTP server exists behind a NAT configuration, set the `MasqueradeAddress` option to the FTP server’s public IP address, as in the following example: `MasqueradeAddress: 203.0.113.0` If your server **does not** exist in a NAT configuration, set the `MasqueradeAddress` option to the following entry: `MasqueradeAddress: ~` Important: Only **one** `MasqueradeAddress` entry can exist in a configuration file.
4. If you want to change your server’s default passive port range, run the following commands: `1 2` `echo "PassivePorts: 49152 65534" >> /var/cpanel/conf/proftpd/local /usr/local/cpanel/scripts/setupftpserver proftpd --force`
5. Configure your server to allow the passive port range to pass through the firewall. To do this, follow the directions in the [Configure the firewall](https://docs.cpanel.net/knowledge-base/ftp/how-to-enable-ftp-passive-mode/#configure-the-firewall) section below.
6. Restart the ProFTP service with the following command: `/usr/local/cpanel/scripts/setupftpserver proftpd --force`

### Configure the firewall

Note:

The system enables passive ports `49152` through `65534` for Pure-FTPd servers and ProFTPD servers by default.

You may need to add your FTP server’s passive port range to the firewall manually.

### ConfigServer Security & Firewall

If you use the ConfigServer Security & Firewall (CSF) plugin to manage your server’s firewall, open the `/etc/csf/csf.conf` file, and confirm that the passive port range exists at the end of the `TCP_IN` line. The system adds your FTP server’s passive port range to the firewall by default. For more information about how to install and use CSF, [visit the CSF website](https://www.configserver.com/cp/csf.html).

### nftables

If you use the `nftables` framework for your CentOS 8, AlmaLinux 8, or CloudLinux 8 server, run the following commands to add the passive port range to your server’s firewall:

| `1 2` | `nft add rule filter INPUT tcp dport 49152-65534 accept nft -s list ruleset \| tee /etc/sysconfig/nftables.conf # to save the ruleset post reboot` |
| --- | --- |

You will find the `nftables` ruleset for your server in the `/etc/sysconfig/nftables.conf` file.

Warning:

cPanel & WHM version 92 for CentOS 8 and CloudLinux 8 is **experimental** software and is **not** recommended for production environments. For more information, read our [cPanel & WHM version 92 for CentOS 8](https://docs.cpanel.net/knowledge-base/experimental-software/cpanel-whm-version-92-for-centos-8) documentation.

Upgrade to a later version of cPanel & WHM to use CentOS 8 and CloudLinux 8 in production environments.

### firewalld

If you use the `firewalld` application for your CentOS 7, CloudLinux™ 7, or Red Hat® Enterprise Linux (RHEL) 7 server, run the following commands to add the passive port range to your server’s firewall:

| `1 2 3` | `firewall-cmd --permanent --zone=public --add-service=ftp firewall-cmd --permanent --add-port=49152-65534/tcp firewall-cmd --reload` |
| --- | --- |

### iptables

Important:

Red Hat Enterprise Linux 8 deprecated the `iptables` utility. While cPanel, L.L.C. does not support this version of RHEL, this change affects all [cPanel-supported operating systems](https://docs.cpanel.net/installation-guide/). We recommend the `nftables` utility for [servers that run CentOS 8, AlmaLinux 8, or CloudLinux 8](https://docs.cpanel.net/knowledge-base/general-systems-administration/how-to-configure-your-firewall-for-cpanel-services/#centos-8-almalinux-8-or-cloudlinux-8-firewall-management). For [servers that run CentOS 7, CloudLinux 7, or RHEL 7](https://docs.cpanel.net/knowledge-base/general-systems-administration/how-to-configure-your-firewall-for-cpanel-services/#centos-7-cloudlinux-7-and-rhel-7-firewall-management), we recommend that you use the `firewalld` utility.

Warning:

cPanel & WHM version 92 for CentOS 8 and CloudLinux 8 is **experimental** software and is **not** recommended for production environments. For more information, read our [cPanel & WHM version 92 for CentOS 8](https://docs.cpanel.net/knowledge-base/experimental-software/cpanel-whm-version-92-for-centos-8) documentation.

Upgrade to a later version of cPanel & WHM to use CentOS 8 and CloudLinux 8 in production environments.

For more information, read Red Hat’s [When to use firewalld, nftables, or iptables](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking#when-to-use-firewalld-nftables-or-iptables_getting-started-with-nftables) documentation.

If you use the `iptables` application for your FTP server’s firewall, perform the following steps to add the passive port range to your server’s firewall:

1. Install the `iptables-services` package if it does not already exist on your server. This package provides the `iptables` and `ip6tables` services, which are not included in the `iptables` application. To install this package, run the following command: `yum install iptables-services`
2. Run the following commands to add the rules to the firewall and save the configuration: `1 2` `iptables -I INPUT -p tcp --dport 49152:65534 -j ACCEPT service iptables save`

## SolusVM and Xen

If you use [SolusVM](https://solusvm.com/) and [Xen®](https://xenproject.org/) on a CloudLinux™ server, you may experience problems with Passive FTP. These problems may resemble a firewall or other connection issue, even when no firewall exists.

To resolve these issues, perform the following steps:

1. Replace the `IPTABLES_MODULES= ip_conntrack_netbios_ns` line in the `/etc/sysconfig/iptables-config` file on the VPS node with the following line: `IPTABLES_MODULES=ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp ipt_owner ipt_REDIRECT`
2. Run the `service iptables restart` command to restart the `iptables` service.

## Troubleshoot FTP passive mode

If your NAT-configured server cannot execute Passive FTP connections to other IP addresses on the server, perform either of the following actions:

- In cPanel & WHM version 66 and later, set the `ForcePassiveIP` option with a tilde (`~`) character. The system interprets this character as an undefined directive and prevents automatic changes to the `/etc/pure-ftpd.conf` or `/etc/proftpd.conf` files.
- In cPanel & WHM version 64 and earlier, follow the directions in our [Passive FTP and NAT Configuration Temporary Workaround](https://docs.cpanel.net/knowledge-base/ftp/passive-ftp-and-nat-configuration-temporary-workaround) documentation.