Enabling FTP Passive Mode in cPanel: Step-by-Step Guide

Active and Passive are two modes of FTP protocol. The FTP server can operate in active and passive. Today we are going to explain how to setup FTP Passive Mode on cPanel using for Pure-FTPd and ProFTPd servers.

Active FTP vs Passive FTP

FTP uses two data channels between the FTP client and the FTP Server with separate TCP connections, the command channel is used for commands and responses, the FTP Data transmitted between client and servers uses a data channel just for that purpose. FTP uses two channels between client and server, the command channel and the data channel, which are actually separate TCP connections.

When FTP connection is Active, the FTP client establishes the command channel from X port on client’s host to destination port 21, and the server defines the data channel from 20 Port to the FTP client port.

In FTP passive mode, the difference is that the client establishes both channels and the server tells the client which port should be used for the data channel.

FTP Passive mode is often used when you have problems working with FTP Active mode (eg. when the server can’t establish the data channel), this is common when you have firewall rules over the network that are blocking normal usage of FTP active connections.

How can I configure FTP Passive Mode on cPanel?

On cPanel servers, you can enable FTP passive mode if you are using Pure-FTPd or ProFTPd server.

Enable FTP Passive on Pure-FTPd

Follow the next steps to enable FTP passive mode on cPanel servers:

nano -w /etc/pure-ftpd.conf

Uncomment / remove the $ from the beginning of the line that contains PassivePortRange variable. Make sure you set the PassivePortRange to a port value greater or equal than 1024.
After the changes, your PassivePortRange variable should look like this:

# Port range for passive connections replies. - for firewalling.
PassivePortRange          30000 50000

It is recommended to set a large number of ports for the passive connections. By default cPanel comes with 30k to 50k, however you can change it as you like, as long as it is a large number.

Important: if you are running your FTP server behind NAT configuration, you will have to add an additional configuration.
Set ForcePassiveIP to the public IP address of your server. For example:

# Force an IP address in PASV/EPSV/SPSV replies. - for NAT.
# Symbolic host names are also accepted for gateways with dynamic IP
# addresses.
ForcePassiveIP XX.XX.XX.XX

Make sure you replace XX.XX.XX.XX with your real IP address.
Once ready, save your modifications and exit the text editor.

Apply this changes to Pure-FTPd configuration to avoid cPanel updates overwriting the Pure-FTPd main configuration files and changes you did earlier in this post

echo "PassivePortRange: 30000 50000" >> /var/cpanel/conf/pureftpd/main
/usr/local/cpanel/scripts/setupftpserver pure-ftpd --force

If your FTP server is behind a NAT run this echo command

echo "ForcePassiveIP: 10.3.5.333" >> /var/cpanel/conf/pureftpd/main

Enable FTP Passive on ProFTPd

FTP Passive mode can be enabled for ProFTPd server, follow the next steps:

nano -w /etc/proftpd.conf 

Add this line to the first block of the configuration file:

PassivePorts 30000 50000

If your ProFTPd server is behind a NAT configuration add this extra lines:

MasqueradeAddress server.hostname.com
MasqueradeAddress XX.XX.XX.XX

Replace server.hostname.com with your real server hostname.
Replace XX.XX.XX.XX with your real FTP server public IP address

Save and close the file.

To prevent cPanel overwrite your changes on cPanel updates, let’s make this changes permanent by running:

echo "PassivePorts: 30000 50000" >> /var/cpanel/conf/proftpd/main
/usr/local/cpanel/scripts/setupftpserver proftpd --force

Configure your Firewall for Passive FTP connections

If you are using CSF firewall follow this steps:

nano -w /etc/csf/csf.conf

Now search for this TCP_IN line, example:

# Allow incoming TCP ports
TCP_IN = "20,21,22,25,26,53,80,110,143,443,465,587,993,995,2077,2078,2082,2083,2086,2087,2095,2096"

And add your passive FTP port range, it should look like this:

# Allow incoming TCP ports
TCP_IN = "20,21,22,25,26,53,80,110,143,443,465,587,993,995,2077,2078,2082,2083,2086,2087,2095,2096,30000:50000"

Restart CSF to apply changes:

csf -r

If you are running a generic iptables based configuration, this should be enough to open those ports:

iptables -I INPUT 2 -p tcp --dport 30000:50000 -j ACCEPT
service iptables save

Restart your Pure-FTPd server

/usr/local/cpanel/scripts/restartsrv_ftpserver


The End! should you have any inquiries, we encourage you to reach out to the Vercaa Support Center without hesitation.