FTP connection problems: passive mode, firewalls, proxies and timeouts

Most FTP failures fall into a handful of patterns, and the log usually names the pattern if you know what to look for. This page lists the common ones, what causes each, and what FTPShell Client does about it automatically or with one setting. The port reference explains the connections involved.

Login works, then the directory listing fails or hangs

The control connection on port 21 is fine; the data connection is not. In active mode the server cannot connect back to you through your router or firewall; in passive mode the server's advertised port is blocked, or the server announced a private address because it sits behind NAT. Fix: use passive mode (the FTPShell default); if the first listing fails FTPShell tries the other mode once by itself and keeps the mode that works. For FTPS, passive replies carrying a private NAT address are corrected automatically. If both modes fail, the server's passive port range is not reachable and the server administrator has to open it.

Connection refused

Nothing is listening on the address and port you used, or a firewall rejects it outright. Fix: check the port against the protocol: 21 for FTP and FTPS explicit, 22 for SFTP, 990 for FTPS implicit. Connecting to an SFTP-only host with an FTP session, or to port 21 on a server that only runs implicit FTPS, gives exactly this error. Open the matching session type in FTPShell and the right port is filled in.

Connection timed out

Packets are going nowhere: a wrong address, a firewall that silently drops the port, a server that is down, or a VPN or proxy in the path. Fix: confirm the host name resolves, try the port from another network if you can, and ask whether the server requires a proxy. FTPShell retries a failed connection every 62 seconds up to 300 times by default, so a server that comes back later is caught without you watching.

530 Login incorrect, or authentication failures on SFTP

Wrong login or password, a login that belongs to a different protocol (hosting accounts often have separate FTP and SFTP users), an account that is locked, or an SSH server that only accepts a method the client did not offer. Fix: re-enter the credentials, confirm the user is enabled for the protocol you are using, and on SFTP let the client's automatic method fallback (password, then keyboard-interactive) do its work; FTPShell tries them in a fixed order and shows the server's banner in the log.

425 Can't open data connection, 426 Connection closed, transfer aborted

Data-connection problems again: the port could not be opened (425) or was cut mid-transfer (426), often by a firewall that closes connections it cannot inspect, which is common with FTPS because the PASV reply is encrypted. Fix: passive mode, a reachable passive range, and for FTPS a client that reuses the TLS session on the data connection as hardened servers require; FTPShell does. Interrupted transfers resume from the break on the next run.

The session drops after a few minutes of inactivity

Servers and firewalls close idle connections. Fix: keep-alive. FTPShell sends a harmless command (PWD, TYPE A or TYPE I) every 120 seconds on FTP and FTPS sessions so the connection stays open while you work in another window; when a server does close the connection, the log says so and the tab icon changes.

It works at home but not at the office

Corporate networks route FTP through a proxy or block it entirely. Fix: FTPShell's global firewall/proxy setting routes logins through an FTP-aware proxy using the User@Host Port or User@Host:Port formats; scripts can tunnel SFTP through an authenticated HTTP CONNECT proxy. If the network allows SSH, an SFTP session on port 22 often works where FTP cannot.

FTPS connects on another client but not this one, or on this server but not that one

FTPS servers differ in which TLS upgrade they accept and whether they require the TLS session to be reused on the data connection. Fix: a client that negotiates AUTH TLS, TLS-C, TLS-P and SSL in turn and reuses the session. FTPShell does both, and offers explicit and implicit FTPS as separate session types for servers that only speak one of them.

Listings look wrong: no dates, files shown as folders, odd names

The server returns a listing format the client does not parse, or a minimal server only supports NLST. Fix: FTPShell recognises UNIX ls -l, DOS/Windows (IIS) and EPLF listings automatically, resolves symbolic links, and has per-site options for NLST-only servers, hidden files and raw listing output.

Large file stops at 2 GB or 4 GB, or progress goes wrong

32-bit size counters in the client or the protocol. Fix: use SFTP or FTPS, where FTPShell uses 64-bit sizes and offsets so progress, percentages and resume work beyond 4 GB; keep plain FTP transfers under 4 GB.

Questions people ask

Should I use active or passive FTP?

Passive, almost always. Active mode needs the server to connect back to your PC, which routers and firewalls block. FTPShell defaults to passive and switches automatically if a listing fails.

Why does my FTP client say "failed to retrieve directory listing"?

The data connection could not be opened after a successful login: wrong transfer mode, a blocked passive port range, or a server announcing a private address. Switch modes, then ask the server administrator about the passive range.

What does FTP error 530 mean?

The login was refused: wrong credentials, a disabled account, or a user not enabled for the protocol you are using.

Why does the connection keep timing out?

A firewall drops the port, the address is wrong, or the server is unreachable from your network. Check the port for the protocol, try another network, and let automatic reconnect retry in the background.

Why does FTPS fail where FTP works?

Firewalls cannot read the encrypted PASV reply to open the data port, and some servers require TLS session reuse. Use a client that reuses the session, and make sure the server's passive range is reachable; or use SFTP, which needs only port 22.

FTP connection refused on Windows Server 2012, 2016 or 2019: what to check

Connection refused from a Windows Server means nothing is listening on the port you used. Check that the FTP service is running (the IIS FTP service, or FTPShell Server's service), that it listens on the expected port, and that the Windows Firewall allows inbound TCP on that port and on the passive range. If the server only runs SFTP, connect with an SFTP session on port 22 instead.

SFTP: 'Received message too long', 'received too large packet' or 'permission denied (publickey)'

Received message too long, or a packet too large, means the server's shell printed text (a message in .bashrc or .profile) before the SFTP subsystem started, and the client read that text as protocol data; the fix is on the server, by keeping login scripts silent for non-interactive sessions. Permission denied (publickey) means the server accepts only key authentication for that account: load a key in a script with pkeyload (Enterprise) or ask the administrator to enable password or keyboard-interactive login.

FTP-proxy and proxy settings: when the connection only works through a proxy

Corporate networks often pass FTP through an FTP-proxy. In FTPShell's global Firewall/proxy settings, enter the proxy address and choose the login format the proxy expects, User@Host Port or User@Host:Port; the proxy then logs in to the real server on your behalf. Scripts can additionally tunnel SFTP sessions through an authenticated HTTP CONNECT proxy with proxyhttp.

What does 'entering extended passive mode' mean?

It is the message a Unix-style client prints when it sends EPSV instead of PASV: the newer passive command that works with IPv6 as well as IPv4. It is informational, not an error. If a transfer hangs after it, the server's passive port range is not reachable; FTPShell retries with the other transfer mode automatically.