Most ProFTPD connection failures on a Linux VPS are caused by passive-mode data connections using a private address or blocked port range. Set MasqueradeAddress to the VPS public IPv4 address, define a fixed PassivePorts range, allow TCP port 21 and that range through both the VPS firewall and the hosting provider’s firewall, then restart ProFTPD and confirm the address in its logs. The procedure below also separates control-channel failures from passive data-channel failures so you can fix the right layer.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Understand what is failing: control channel or data channel
FTP uses more than one connection. The client first opens a control connection to TCP port 21. After login, directory listings and file transfers use a separate data connection. In passive mode (PASV or EPSV), the client asks the server to listen on a temporary port and then connects to that port. A VPS behind NAT, a host firewall, or a provider firewall can allow port 21 while blocking the data connection.
As an Amazon Associate I earn from qualifying purchases.
This distinction explains a common symptom: authentication succeeds, but a directory listing hangs, times out, or returns an empty view. It also explains why opening only port 21 rarely fixes passive FTP.
| Symptom | Likely layer | First check |
|---|---|---|
| Connection refused or timeout before the login prompt | Control channel, service state, or port-21 firewall rule | systemctl status proftpd, listening sockets, and TCP 21 rules |
| Login works, but listing or transfer times out | Passive data address or passive-port firewall rules | The server’s 227 Entering Passive Mode reply and the selected port |
| The PASV reply contains a private/LAN address | NAT advertisement in ProFTPD configuration | MasqueradeAddress and duplicate configuration entries |
| Transfers work for a while and then disconnect | Idle timeout, exhausted passive ports, or an intermittent firewall | TimeoutIdle, passive-range size, and firewall logs |
Confirm the public address in the PASV reply
Use a verbose FTP client
Connect with a client that displays protocol responses. In a command-line FTP client, enable verbose output before logging in and request a directory listing. A passive response normally starts with 227 Entering Passive Mode and includes an IPv4 address plus a port encoded as two numbers. For example, an address of 192,168,1,20 represents 192.168.1.20. On a public VPS, advertising a private address is a configuration error: the remote client cannot route to it.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Some clients use EPSV, which returns only a port. EPSV avoids putting an IPv4 address in the reply, but the server still has to listen on a reachable passive port, and firewalls must allow it. Test with the client mode your users actually use; a successful login alone does not prove that data connections work.
Check from the client side
Record the address and port shown immediately before the listing or transfer. If the address is the VPS’s public address but the connection still times out, test the advertised port from the client network while a passive operation is pending. A refusal usually means the service is not listening or a rule is rejecting the connection; a timeout more often indicates a dropped packet or a missing provider-firewall rule.
Do not test only from another process on the VPS. Local tests can succeed even when an external client is blocked by NAT or a cloud firewall.
Set MasqueradeAddress for NAT
Find the active ProFTPD configuration
On many distributions the main file is /etc/proftpd/proftpd.conf, with additional files under /etc/proftpd/conf.d/ or a similar include directory. The exact layout depends on the package. Before editing, identify every occurrence of the NAT and passive-mode directives:
grep -RniE '^[[:space:]]*(MasqueradeAddress|PassivePorts)b' /etc/proftpdIf more than one active declaration exists, determine which file is included last and remove or comment out conflicting entries. Duplicate directives are a low-confidence but real source of confusion because an administrator may edit one file while ProFTPD reads another. Keep one deliberate value in the effective configuration.
Use the VPS public IP, not a DNS name
Add the public IPv4 address assigned to the VPS, for example:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsMasqueradeAddress 203.0.113.10203.0.113.10 is a documentation address; replace it with the address shown in your hosting control panel or assigned to the VPS. Do not use the server’s private interface address (such as 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16). Do not use a hostname for this directive when troubleshooting NAT: DNS can resolve differently for different clients and can obscure which address ProFTPD is advertising.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
If the VPS has a provider-level one-to-one NAT, use the public address that external clients must reach, even if the operating system shows a private address on its interface. If the provider gives the VPS the public address directly, use that address. When the public address changes, update the directive and restart ProFTPD.
Validate and restart
Run the configuration test supported by your package before restarting:
proftpd -tA successful test should report no syntax errors. If your distribution installs the binary elsewhere, run the equivalent test command documented by that package rather than guessing a path. Then restart and check the service:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo systemctl restart proftpd
sudo systemctl status proftpd --no-pagerAn inactive service, a failed restart, or a syntax error must be fixed before investigating passive ports. A running process that is bound only to loopback is also unusable remotely; verify its listeners with ss in the next section.
Pin a reachable passive-port range
Why an explicit range matters
PassivePorts tells ProFTPD which TCP ports it may use for passive data connections:
PassivePorts 49152 50152The example provides 1,001 ports and is intentionally non-privileged. You can choose another range at or above 1024, provided it does not conflict with another service and is large enough for simultaneous transfers. A single client can consume more than one data connection when it opens multiple transfers, and many users increase the requirement.
There is no fixed default for PassivePorts. If it is not set, the operating system can choose a port. That makes firewalling difficult because the range is unknown. A too-small range can also prevent new transfers when all ports are occupied. Some field reports describe a fallback to a kernel-assigned port when the configured range cannot be used; treat that behavior as version- and configuration-dependent rather than guaranteed.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Choose the range around your workload
- For one or two occasional users, a modest range can be sufficient, but leave headroom for retries and concurrent listings.
- For automated jobs or many users, allocate a wider contiguous range and open exactly that range in every firewall.
- Do not overlap the range with ports used by SSH, databases, control panels, or other daemons.
- Document the range so a later firewall change does not silently break transfers.
After editing the directive, restart ProFTPD. A configuration change does not alter already-established data connections; test a new login and a new transfer.
Open both firewall layers
A VPS commonly has two independent filters: the operating-system firewall and a firewall in the hosting provider’s control plane. Both must allow TCP port 21 and the complete passive range. Opening one while leaving the other closed produces the same timeout as a ProFTPD error.
UFW
For a server managed with UFW, allow the control channel and the selected range:
sudo ufw allow 21/tcp
sudo ufw allow 49152:50152/tcp
sudo ufw status numberedKeep any source restrictions you already use; if FTP should be reachable only from known office or automation addresses, scope the rules rather than exposing them globally. Confirm that UFW is actually enabled and that another firewall manager is not replacing its rules.
iptables
On systems that manage filtering directly with iptables, equivalent rules are:
sudo iptables -A INPUT -p tcp --dport 21 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 49152:50152 -j ACCEPT
sudo iptables -L INPUT -n -vPersist the rules using the mechanism provided by your distribution. A rule visible in the current kernel table can disappear at reboot if it was not saved.
firewalld
With firewalld, open the control port and passive range in the active zone:
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
sudo firewall-cmd --permanent --add-port=21/tcp
sudo firewall-cmd --permanent --add-port=49152-50152/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --list-portsCheck that the commands target the zone attached to the VPS interface. Adding a rule to an unused zone does not open the port.
Provider or cloud firewall
In the hosting dashboard, add inbound TCP rules for port 21 and the same passive range. Some providers call this a network firewall, security group, packet filter, or access-control list. Verify the rule’s destination, protocol, source range, and applied network interface. If the VPS is behind a separate NAT gateway, confirm that the gateway forwards both port 21 and the passive range to the VPS; forwarding only port 21 is insufficient.
Verify listeners, logs, and the effective configuration
Confirm port 21 is listening on a reachable interface
sudo ss -ltnp | grep -E '(:21|:49152|:49153|:50152)'
Immediately after starting a transfer, a passive port from the configured range should appear as a listening socket. If port 21 is bound only to 127.0.0.1 or ::1, adjust the service’s bind or address settings according to your distribution package. If no passive listener appears, inspect the ProFTPD log and configuration test output before changing firewall rules.
Read the ProFTPD log while reproducing the failure
sudo journalctl -u proftpd -fPackage-specific logs may also be under /var/log/proftpd/ or the system authentication and daemon logs. The path and message format vary by distribution and logging configuration. Reproduce one failed listing while watching the log, then stop following it with Ctrl+C.
Recommended Free Tools
After setting MasqueradeAddress, look for a startup or session message that shows the configured address. The log should agree with the public address in the client’s PASV response. If it shows the old address, ProFTPD did not load the file you edited, another included file overrides it, or the service was not restarted.
Check the running process, not only the text files
Inspect the service command line and included configuration locations if the result is unexpected:
systemctl cat proftpd
ps -ef | grep '[p]roftpd'Distribution units can pass an alternate configuration file with a command-line option. That explains why a syntactically correct edit in /etc/proftpd/proftpd.conf sometimes has no effect.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Troubleshoot by symptom
“Connection refused” on port 21
- Run
sudo systemctl status proftpdand inspect the last startup error. - Confirm a listener with
sudo ss -ltnp | grep ':21'. - Check local firewall counters and the provider firewall’s inbound rule for TCP 21.
- Test from an external network, because a local loopback test cannot verify public reachability.
If the service repeatedly exits, correct its configuration or file-permission error first. If it is listening but remote clients time out, inspect routing and both firewall layers.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchLogin succeeds but directory listing hangs
This is the classic passive-mode failure. Capture the PASV/EPSV response, compare its address with the public VPS address, and verify that the returned port falls inside PassivePorts. Set MasqueradeAddress if the address is private, then open the whole range in both firewalls.
The PASV response advertises an old or unexpected address
Search all included files for duplicate directives, inspect systemctl cat proftpd for an alternate configuration path, and restart the service. A DNS record changing does not change the literal address configured in MasqueradeAddress. If the VPS public IP changed, update the directive explicitly.
A transfer starts, then stalls or fails intermittently
- Check whether the selected port is in the allowed range and whether the provider firewall allows every port, not just the first or last one.
- Look for port exhaustion during concurrent transfers. Increase the range and retest if all ports are in use.
- Compare failures from different client networks. A corporate or hotel network may block FTP data ports even when the VPS is configured correctly.
- Review idle-disconnect settings if the failure occurs only after inactivity.
The session disconnects after sitting idle
TimeoutIdle defaults to 600 seconds. A value of 0 disables the idle timeout. Set a different value only when you understand the security and resource implications, and verify the value against the ProFTPD version installed on the VPS. An idle timeout does not explain an immediate failure during a listing; diagnose passive addressing and firewalls first in that case.
Only some clients fail
Compare whether the working and failing clients use EPSV or PASV, IPv4 or IPv6, and different source networks. A DNS name with both A and AAAA records can send clients down different paths. Test the VPS’s public IPv4 address directly and ensure the corresponding provider and host firewall rules exist. Do not assume that success from one network proves that every client can reach the passive range.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Defaults and settings that affect diagnosis
| Directive or setting | Value relevant to troubleshooting | What it means |
|---|---|---|
MasqueradeAddress |
Must be set to the externally reachable address when NAT requires address rewriting | Controls the address ProFTPD advertises for passive connections; use the public IP, not a private LAN address or a DNS name. |
PassivePorts |
No default | Without it, the kernel can choose a port, making firewall rules unpredictable. Define a fixed non-privileged range. |
MaxClients |
No default | Do not infer a limit from an assumed default. Check the effective configuration and available VPS resources when many sessions are expected. |
TimeoutIdle |
600 seconds by default; 0 disables it |
Controls how long an otherwise idle session remains connected. Verify the installed version’s behavior. |
Defaults can differ with package patches and ProFTPD versions. Treat the table as a diagnostic starting point and confirm the active values in your own configuration and logs.
Security and protocol choices
Plain FTP sends credentials and data without encryption. Once connectivity is restored, decide whether the service should use an encrypted FTP mode supported by your ProFTPD setup, or whether users can use SFTP through the VPS’s SSH service instead. SFTP is a different protocol and does not use ProFTPD’s port 21 or passive-port range; changing a client to SFTP is a migration choice, not a fix for a broken ProFTPD configuration.
Restrict port 21 and the passive range to known source addresses when possible, keep the range no wider than operationally necessary, and monitor authentication logs for repeated failures. Avoid opening arbitrary high ports merely because a client reports a timeout; the range in the ProFTPD configuration and the ranges in both firewalls must match exactly.
A repeatable repair checklist
- Reproduce the problem with verbose protocol logging and determine whether port 21 or the data connection fails.
- Inspect the PASV/EPSV response. For PASV, confirm that the advertised address is the VPS public address.
- Search the complete ProFTPD configuration tree for
MasqueradeAddressandPassivePorts; remove conflicting active entries. - Set
MasqueradeAddressto the public IPv4 address and define a fixed passive range at or above port 1024. - Choose a range large enough for the expected concurrent transfers and ensure no other service uses it.
- Run
proftpd -t(or the equivalent package command), then restart ProFTPD. - Allow TCP 21 and the entire passive range in UFW, iptables, or firewalld, and in the hosting provider’s firewall or security group.
- Watch
journalctl -u proftpd -fwhile performing a new login and transfer. Confirm the log and client response show the same public address. - Use
ssto verify that port 21 and a selected passive port are listening when a transfer is pending. - If the failure remains, compare clients and networks, check for provider NAT or an IPv6 path, and review firewall drop counters before widening access.
The decisive test is a complete transfer from an external client: successful login, directory listing, download, and upload. Once those work with the configured address and range, leave the rules documented so future VPS, DNS, or firewall changes do not recreate the same failure.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
