JSCAPE
  • Products
    • Managed File Transfer
    • JSCAPE SaaS
    • MFT Gateway
    • MFT Monitor
    • All Products
  • Solutions
    • All Solutions
    • Secure File Transfer
    • AS2 Server Software
    • File Synchronization
    • Reverse Proxy
    • Compliance
    • DMZ Streaming
  • Pricing
  • Company
    • Blog
    • Company
    • Contact Us
    • Clients
    • Case Studies
    • Testimonials
    • Certifications
  • Support
    • Help Desk
    • Documentation
    • Customer Downloads
Get a demo

Active vs. passive FTP simplified

Words by

John Carl Villanueva

Data connection mode When your File Transfer Protocol (FTP) server runs behind a firewall or Network Address Translation (NAT) router, your users may sometimes encounter connectivity issues. One of the most common causes of FTP connection issues is the data connection mode being used. This mode can be either active or passive. Certain firewall configurations…

Published in:

Blog

/

FTP, ftp active mode, ftp active vs passive, ftp passive mode, SFTP, sftp port

dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410482″>File Transfer Protocol (FTP) server runs behind a dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410497″>router, your users may sometimes encounter connectivity issues. One of the most common causes of dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410476″>data connection mode being used. This mode can be either active or passive. Certain dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410477″>FTP connections if the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410473″>passive FTP dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewall configurations and what mode we recommend you use going forward. Although active and RFC 959, the explanations can be too technical. Before we tackle the main discussion, let’s first review dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410477″>FTP

dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410498″>commanddropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410485″>data channel

Every dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410498″>command channel and a dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410507″>FTP commands and command responses go through the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410485″>data channel.

Your dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410483″>TCP dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410507″>FTP dropdown#toggle” data-dropdown-menu-id-param=”menu_term_295410498″ data-dropdown-placement-param=”top” data-term-id=”295410498″> channel will use port 21 on the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410485″>data channel, the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410479″>portdropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410476″>data connection mode used. In dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410490″>server dropdown#toggle” data-dropdown-menu-id-param=”menu_term_295410479″ data-dropdown-placement-param=”top” data-term-id=”295410479″> number for the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410471″>passive mode, this would be a dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410479″>portftp command channelIt’s worth noting that other dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410482″>File Transfer Protocol (dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410496″>data transfers. 


Are you still using an SFTP server but ready for unrivaled file transfer reliability? 

If you’re looking for reliable file transfer operations and the ability to scale and standardize these processes, let us show you what might be missing as you work towards enhanced performance.

Schedule a product demo with one of our specialists, who will reveal how to improve operational efficiency while keeping your data secure.

Want to try this for yourself?

Request a free trial.


This two-channel property is unique to the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410515″>SSL a.k.a FTPS. Indeed, dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewall connectivity issues that affect FTP. So, if you’re using FTPS instead of FTP, you also benefit from our discussion here.

If you need assistance using secure dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410477″>FTP connections, you can schedule a demo with one of our experts.

Let’s now differentiate between dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410506″>passive modedropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410476″>data connection. For instance, it should be easy to see that the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410498″>command channel connection (the top arrow) regardless the mode used.

What is dropdown#toggle” data-dropdown-menu-id-param=”menu_term_295410500″ data-dropdown-placement-param=”top” data-term-id=”295410500″> FTP?

Older versions of FTP used to run on only one dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410474″>active mode. Since this mode is common in legacy FTP systems, many FTP software use this as the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410500″>active modedropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410475″>FTP client and dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410472″>FTP server on dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410479″>portdropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410492″>random port on its file transfer client. This dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410492″>random port and dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410498″>command channel or dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410487″>PORT command, while specifying what random dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410489″>client-side port will be used later on for the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410489″>client-side port specified in step 1 for the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410474″>active mode, the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410476″>data connection. Once the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410502″>directory listings are coursed through this connection.

active mode ftp

What is dropdown#toggle” data-dropdown-menu-id-param=”menu_term_295410506″ data-dropdown-placement-param=”top” data-term-id=”295410506″> FTP?

As hinted earlier, dropdown#toggle” data-dropdown-menu-id-param=”menu_term_295410506″ data-dropdown-placement-param=”top” data-term-id=”295410506″> FTP is the more recent dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410474″>active mode, modern GUI-based or dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410475″>FTP clients also support dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410505″>passive connections.

  1. As in dropdown#toggle” data-dropdown-menu-id-param=”menu_term_295410500″ data-dropdown-placement-param=”top” data-term-id=”295410500″> FTP, the client initiates the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410475″>FTP client connects to the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410483″>TCP port 21. But instead of sending the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410481″>PASV command. This tells the server that the client wishes to transfer files using dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410492″>random port from its own set of ports for the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410490″>server port to connect to for the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410485″>data channel connection. The client connects from a dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410493″>data port specified by the server in step 1. Once the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410496″>data transfers and

    You’re ready to discuss the firewall considerations you need to make when dealing with FTP in either active or passive mode.

    Discover the 3 critical fixes to combat hackers and bad actors

    dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewall responds to an dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410489″>Client-side dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewall configurations are lenient to outbound connections but more restrictive when it comes to inbound connections. So, for example, if you have a dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewall and an dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410472″>FTP server at port 21, the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewall’s point of view, the connection attempt is outbound.

    client side firewalls

    In fact, from any dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewall’s point of view, all FTP dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410475″>FTP clients shouldn’t have a problem establishing a dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410472″>FTP server. However, the same thing can’t be said for dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410500″>active modedropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410476″>data connection. Since the connection is inbound from the Client side firewall point of view

    So, if a user encounters a connectivity issue while attempting to connect to your dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410474″>active mode.

    If it is, a dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewall is likely block the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410489″>client-side dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410499″>Microsoft dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewall to check would be your user’s dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewall.

    You’re less likely to encounter similar issues with a dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410503″>FTPdropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410473″>Passive dropdown#toggle” data-dropdown-menu-id-param=”menu_term_295410509″ data-dropdown-placement-param=”top” data-term-id=”295410509″> works better with dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewalls because both the command connection and the dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewall’s point of view, all connection attempts are outbound.passice ftp mode

    All right, that’s for client-side firewalls. Before we do server-side firewalls, here’s a friendly reminder that you can test JSCAPE features inside your own environment with support from a product expert. Click here to request your no-obligation, risk-free trial.

    dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewalls

    When you deploy an dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410491″>server-side dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410475″>FTP clients to connect with that server. That means you’ll want to open port 21 on that dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410498″>command channel connection attempt to pass through. But how about
    command channel connection request
    Normally, a dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewall won’t pose any problems to dropdown#toggle” data-dropdown-menu-id-param=”menu_term_295410500″ data-dropdown-placement-param=”top” data-term-id=”295410500″> dropdown#toggle” data-dropdown-menu-id-param=”menu_term_295410477″ data-dropdown-placement-param=”top” data-term-id=”295410477″> connections. That’s because the connection attempt is directed to the client, which means, from the

    Since a dropdown#toggle” data-dropdown-menu-id-param=”menu_term_295410506″ data-dropdown-placement-param=”top” data-term-id=”295410506″> FTP dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410491″>server-side dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewall should block that attempt, right? Generally speaking, yes. That’s why you should explicitly open a dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410491″>server-side dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410506″>passive mode

    dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410473″>Passive FTP – Which is better?

    Based on our discussion above, connection issues can happen on a dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewall or a dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewall. Apparently, a dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewall would normally block dropdown#toggle” data-dropdown-menu-id-param=”menu_term_295410500″ data-dropdown-placement-param=”top” data-term-id=”295410500″> FTP dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410491″>server-side dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410506″>passive modedropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410476″>data connection attempts.

    One way to address an dropdown#toggle” data-dropdown-menu-id-param=”menu_term_295410500″ data-dropdown-placement-param=”top” data-term-id=”295410500″> dropdown#toggle” data-dropdown-menu-id-param=”menu_term_295410477″ data-dropdown-placement-param=”top” data-term-id=”295410477″> connectivity issue is to allow inbound connections to certain dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410492″>random ports on your dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewall. Similarly, one way to address a dropdown#toggle” data-dropdown-menu-id-param=”menu_term_295410506″ data-dropdown-placement-param=”top” data-term-id=”295410506″> dropdown#toggle” data-dropdown-menu-id-param=”menu_term_295410477″ data-dropdown-placement-param=”top” data-term-id=”295410477″> connectivity issue is to allow inbound connections to certain dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410491″>server-side dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410489″>client-side dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewalls. So, while opening dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410489″>client-side dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410500″>active modedropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410477″>FTPdropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410506″>passive modedropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410491″>server-side dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410491″>server-side dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewall settings there. So, yes, we recommend you use dropdown#toggle” data-dropdown-menu-id-param=”menu_term_295410506″ data-dropdown-placement-param=”top” data-term-id=”295410506″> FTP moving forward. It’s going to be much easier to avoid connectivity issues that way.

    Security considerations when setting up dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410492″>random ports on your dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410470″>firewall, know that opening ports in wanton abandon can increase your exposure to internet-based cyber threats. The right approach is to configure a dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410472″>FTP server for dropdown#toggle” data-dropdown-menu-id-param=”menu_term_295410506″ data-dropdown-placement-param=”top” data-term-id=”295410506″> FTP dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410501″>range of ports on your dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410473″>passive dropdown#toggle” data-dropdown-menu-id-param=”menu_term_295410495″ data-dropdown-placement-param=”top” data-term-id=”295410495″> port range

    The specific number of ports you need to open for dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410505″>passive connections. While no hard and fast rules dictate the ideal number of ports comprising a port range, you will want to project your maximum number of concurrent users and allocate a sizable allowance based on that estimate.

    Your JSCAPE MFT Server by Redwood, you can specify your dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410495″>FTPdropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410478″>IP address your dropdown#toggle” data-dropdown-placement-param=”top” data-term-id=”295410505″>passive connection requests is not routable through the Internet, you’ll need to enter your public

    Get Your Free Trial

    Want to try this for yourself?

    • Request a free trial
    • Connect with a JSCAPE product expert
    • Test JSCAPE MFT Server, a multi-protocol, platform-independent managed file transfer solution users are most likely to recommend, according to G2.


     

Easy To Deploy, Easy To Administer, Easy To Manage

Ready to see how JSCAPE makes managed file transfer so much simpler? Schedule your demo now.

Request a demo

Popular Articles

View more by

JSCAPE
  •  
    1–2 minutes
    23/09/2025

    JSCAPE by Redwood, version 2025.3: New UI continues to make a splash

    Dive back into JSCAPE by Redwood with version 2025.3, bringing more modern UI updates to make using and navigating JSCAPE more intuitive. 

    Read article

  •  
    1–2 minutes
    19/08/2025

    Weathering the economic storm: Expert support is your enterprise file transfer system’s lifeline

    The global economic landscape can be described by one word: “uncertain”. Lingering effects from the 2020 pandemic, combined with new waves of international tariffs throughout 2025, have…

    Read article

  •  
    1–2 minutes
    30/07/2025

    Escape the grip: Why flexible MFT is key to enterprise agility

    Break free from costly vendor lock-in Let’s be blunt: some MFT vendors have built product suites that are less about true partnership and more about proprietary siloing.…

    Read article

  •  
    1–2 minutes
    23/07/2025

    Avoid downtime and threat actors: Getting the best of both worlds in MFT

    For enterprise organizations relying on managed file transfer (MFT) solutions, cybersecurity often feels like an arms race. The need to patch MFT software vulnerabilities to prevent breaches…

    Read article

Related Content

Read more about

JSCAPE MFT
  •  
    1–2 minutes
    30/07/2025

    Escape the grip: Why flexible MFT is key to enterprise agility

    Break free from costly vendor lock-in Let’s be blunt: some MFT vendors have built product suites that are less about true partnership and more about proprietary siloing.…

    Read article

  •  
    1–2 minutes
    03/07/2025

    Consolidate, deploy and thrive: JSCAPE’s formula for MFT success in uncertain times

    Global enterprises today are navigating a landscape marked by significant economic volatility. Fluctuating markets, shifting trade policies and persistent economic uncertainty are compelling enterprise organizations to reevaluate…

    Read article

  •  
    1–2 minutes
    31/03/2025

    SFTP vs. FTPS: Which file transfer software is best for business use?

    What is SFTP? SFTP is a file transfer protocol that’s normally packaged with Secure Shell (SSH), the network protocol most IT administrators use to access and manage…

    Read article

  •  
    1–2 minutes
    25/03/2025

    EDI integration with trading partners: 6 best practices

    Many large companies with high-volume transactions, especially those involved in e-commerce, manufacturing and retail supply chains, have long migrated from manual processes to Electronic Data Interchange (EDI).…

    Read article

Company

  • About Us
  • Contact Us
  • Clients
  • Case Studies
  • Testimonials
  • Privacy Policy
  • Certifications

Resources

  • Managed File Transfer
  • Secure File Transfer
  • Secure FTP Server
  • AS2 Server
  • Reverse Proxy
  • File Upload Processing
  • What Is An AS2 Server?

Support

  • Help Desk
  • Documentation
  • Customer Downloads
JSCAPE

Copyright © 2025 JSCAPE

  • Privacy Policy
  • Cookie Settings