The FTP protocol can be used in two different ways to establish the connections required for file transfers: active mode and passive mode. To connect to our servers, use passive mode: it works behind most Internet boxes, routers and firewalls.
In short: use passive mode. In FileZilla: File → Site Manager, Transfer Settings tab, Transfer mode set to Passive. Most FTP software already uses it by default.
What to know before you start
- Most FTP software, including FileZilla, already uses passive mode by default. Only change the setting if the connection is established and then freezes while displaying the file list.
- The setting is made in your FTP software, not in the Apanel console.
How do I choose passive mode in FileZilla?
- Open FileZilla, then go to File → Site Manager.
- Select your hosting's site (see Publish your website by FTP to create it).
- Open the Transfer Settings tab.
- Under Transfer mode, choose Passive.
- Click Connect.
In other FTP software, look for an option named "passive mode", "PASV" or "transfer mode" in the connection settings.
Understanding the two modes
What is active mode?
In active mode, it is the FTP client that determines the connection port to be used to allow data transfer. Thus, for the data exchange to take place, the FTP server will initiate the connection from its data port (port 20) to the port specified by the client. The client must then configure its firewall to allow new incoming connections so that the data exchange can occur. Furthermore, this mode can be problematic for users behind a NAT gateway (see below): the FTP server initiates the data connection by connecting to the external address of the NAT gateway on the chosen port. Since some NAT gateways do not have a mapping for the received packet in their state table, the packet will be dropped and will not be delivered to the client.
What is passive mode?
In passive mode, the FTP server itself determines the connection port to be used for the data transfer and communicates it to the client. The client then always opens the connections: the command connection to port 21 of the server, then the data connection to the port announced by the server. The advantage of this mode is that the FTP server does not initiate any connection to the client: it works without problems with clients behind a NAT gateway.
How does NAT work?
A router is said to perform Network Address Translation (NAT) when it maps the non-unique and often non-routable internal IP addresses of an internal network to a set of unique and routable external addresses. This mechanism notably allows a single public external address visible on the Internet to correspond to all addresses of a private network, thereby mitigating IPv4 address exhaustion. This is the case for most Internet boxes.
The transfer stops after a few files (Windows)
On Windows, with encrypted FTP (FTP over TLS, also called FTPS), the transfer starts normally and then stops after a few files: the connection is lost or the software waits forever. It mostly happens when you transfer many files at once, with FileZilla as well as WinSCP.
The cause is a Windows Firewall setting, enabled by default on Windows 11: it tries to read the FTP exchanges to follow the transfer connections. Since the connection is encrypted, it cannot read them, and it ends up blocking the following transfers.
The simplest solution: switch to SFTP
SFTP uses a single encrypted connection, which this setting does not affect. It goes through your SSH access: first save your public key in the Apanel console (see Connect to your account via SSH), then choose the SFTP protocol and port 22 in your software (in WinSCP, set File protocol to SFTP).
Otherwise: turn off FTP tracking in Windows Firewall
If you keep using encrypted FTP, turn this setting off. Open PowerShell as administrator (right-click the Start menu, Terminal (Admin)).
-
Check the setting:
Get-NetFirewallSetting -PolicyStore ActiveStore | Select-Object EnableStatefulFtp
The value True means the setting is enabled.
-
Turn it off:
Set-NetFirewallSetting -EnableStatefulFtp False
-
Start the transfer again.
To restore the original setting: Set-NetFirewallSetting -EnableStatefulFtp True. On a computer managed by your company, this setting may be enforced by the IT department: contact them.
Troubleshooting
- The connection freezes at the file list, even in passive mode: your firewall or antivirus may be filtering FTP connections. Try from another network, or switch to SFTP (see Publish your website by FTP).
- The transfer starts, then stops after a few files: see the section "The transfer stops after a few files (Windows)" above.
- The connection is refused after several attempts: your IP address may have been blocked by the firewall (see below).
Going further