FTP Connection Modes (Active vs. Passive)

FTP may operate in an active or a passive mode, which determines how a data connection is established. In both cases, a client creates a TCP control connection to an FTP server command port 21. This is a standard outgoing connection, as with any other file transfer protocol (SFTP, SCP, WebDAV) or any other TCP client application (e.g. web browser). So, usually there are no problems when opening the control connection.

Where FTP protocol is more complicated comparing to the other file transfer protocols are file transfers. While the other protocols use the same connection for both session control and file (data) transfers, the FTP protocol uses a separate connection for the file transfers and directory listings.

In the active mode, the client starts listening on a random port for incoming data connections from the server (the client sends the FTP command PORT to inform the server on which port it is listening). Nowadays, it is typical that the client is behind a firewall (e.g. built-in Windows firewall) or NAT router (e.g. ADSL modem), unable to accept incoming TCP connections.

For this reason the passive mode was introduced and is mostly used nowadays. It is a default for WinSCP too. Using the passive mode is preferable because most of the complex configuration is done only once on the server side, by experienced administrator, rather than individually on a client side, by (possibly) inexperienced users.

In the passive mode, the client uses the control connection to send a PASV command to the server and then receives a server IP address and server port number from the server, which the client then uses to open a data connection to the server IP address and server port number received.1

Use Passive mode session settings to toggle between the active and the passive mode.

Network Configuration for Passive Mode
- Notes for Uncommon Local Network Configurations
Network Configuration for Active Mode
Smart Firewalls/NATs

Network Configuration for Passive Mode

With the passive mode, most of the configuration burden is on the server side. The server administrator should setup the server as described below.

The firewall and NAT on the FTP server side have to be configured not only to allow/route the incoming connections on FTP port 21,2 but also a range of ports for the incoming data connections. Typically, the FTP server software has a configuration option to setup a range of the ports, the server will use. And the same range has to be opened/routed on the firewall/NAT.

When the FTP server is behind a NAT, it needs to know it’s external IP address, so it can provide it to the client in a response to PASV command.

It is common, that the FTP server is not configured properly and provides its internal IP address, that cannot be used from a client network. By default WinSCP detects, when an unroutable IP address is provided, and uses a server (control connection) address instead.3 You can tell that this happened from a session log:

Server sent passive reply with unroutable address ..., using host address instead.

Learn how to:

Notes for Uncommon Local Network Configurations

When the NAT happens on a client side, what the FTP server cannot know, the IP address it provides is wrong too (from a client’s perspective). You can force WinSCP to ignore the IP address provided by the server using a Force IP address for passive mode connections session setting.

When using a restrictive local firewall that blocks even outgoing connections, you need to open not only control connection port 21, but also a port range for data connections. To open as little ports as possible, find out what ports is the FTP server configured to use. If you cannot know that, you have to open all unprivileged port range, 1024 - 65535.

Network Configuration for Active Mode

With the active mode, most of the configuration burden is on the client side.

The firewall (e.g. Windows firewall) and NAT (e.g. ADSL modem routing rules) on the client side have to be configured to allow/route a range of ports for the incoming data connections. As WinSCP does not allow configuring a range of the ports it uses for data connections, all ports in Windows dynamic port range 49152 - 655354 have to be opened. To open the ports, go to Control Panel > System and Security > Windows Defender Firewall > Advanced Settings > Inbound Rules > New Rule.5 For routing the ports on the NAT (if any), refer to its documentation.

When there’s NAT in your network, you have to configure an external IP address that the WinSCP needs to provide to the FTP server using PORT command. So that the server can correctly connect back to WinSCP to open the data connection. For that use External IP address setting in Preferences.

Smart Firewalls/NATs

Some firewalls/NATs try to automatically open/close data ports by inspecting FTP control connection and/or translate the data connection IP addresses in control connection traffic.6

With such a firewall/NAT, the above configuration is not necessary for a plain unencrypted FTP. But this cannot work with FTPS, as the control connection traffic is encrypted and the firewall/NAT cannot inspect nor modify it.

From an arbitrary client port.Back
Or implicit FTPS port 990Back
Actually very rarely, if ever, the IP address of the data connection is different from the IP address of the control connection.Back
For Windows Vista and later. For details refer to Remarks section in documentation of bind WinAPI function. Back
Just Windows Firewall on Windows 7.Back
For example in the built-in Windows firewall, the function is called StatefulFTP.Back