Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →To make passive FTP work on Ubuntu, configure vsftpd with a bounded passive-port range, allow TCP 21 and that entire range through the Ubuntu firewall, permit established and related traffic, and forward the same ports through any NAT device or cloud firewall. A typical setup uses ports 30000–31000, but that range is an example rather than an Ubuntu default.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
pasv_enable=YES
pasv_min_port=30000
pasv_max_port=31000
# pasv_address=203.0.113.10 # only when NAT requires an advertised public address
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 21 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 30000:31000 -j ACCEPTFTP login can succeed while directory listings, uploads, or downloads hang because those operations use a second connection. The control connection reaches port 21; the data connection reaches a server-selected port in the passive range. Both paths must be reachable.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
How passive FTP differs from the login connection
File Transfer Protocol uses a control connection and a separate data connection. In passive mode, the client opens the control connection to the server’s TCP port 21, sends a PASV or EPSV request, and receives an address and port for the data connection. The client then opens that second TCP connection to the server.
That design explains the common symptom: authentication works, but LIST, uploads, or downloads time out. Port 21 is open, yet the data port is blocked, not forwarded, or advertised incorrectly. Opening only port 21 never completes a passive-mode configuration.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Canonical’s Ubuntu Server documentation describes FTP as “a TCP protocol for downloading files between computers.” The protocol itself does not provide confidentiality: credentials and data are sent in clear text unless a secure alternative is used.
Prerequisites and ownership checks
Confirm the FTP daemon and configuration file
This guide assumes vsftpd. Its main configuration is normally /etc/vsftpd.conf. Before changing anything, save a copy and check the currently active values:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchessudo cp /etc/vsftpd.conf /etc/vsftpd.conf.backup
sudo grep -E '^(pasv_enable|pasv_min_port|pasv_max_port|pasv_address)=' /etc/vsftpd.confIf a setting is absent, vsftpd uses its documented default. The documented defaults for pasv_min_port and pasv_max_port are 0, which allows any port. An unrestricted range is difficult to express safely at a firewall, so set both values explicitly.
Identify the firewall backend before adding rules
Ubuntu has supplied iptables tools that work with the nftables API since Ubuntu 16.04, and nftables became the default backend in Ubuntu 20.10. The command name alone therefore does not tell you whether rules are being translated to nftables.
update-alternatives --display iptables
sudo iptables -S
sudo iptables -L INPUT -n -v --line-numbersAlso determine whether UFW, native nftables, a cloud security group, or another service owns the policy. Netfilter hooks, connection tracking, and NAT are shared infrastructure; two rule managers can overwrite one another or leave a rule that appears in one view but is removed by the other. Use one manager as the source of truth.
Choose and configure a passive-port range
Set a bounded range in vsftpd
Edit /etc/vsftpd.conf and add or change:
pasv_enable=YES
pasv_min_port=30000
pasv_max_port=31000The example provides 1,001 TCP port numbers. It is not an Ubuntu or vsftpd default. Choose a range that accommodates the number of simultaneous data sessions you expect while limiting the firewall exposure required by your security policy. A very narrow range reduces exposed ports but can limit concurrency; a broad range supports more sessions but creates a larger allow-list.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Set the advertised address only when necessary
Normally vsftpd advertises the address associated with the server’s local network interface. If the host is behind NAT, clients may instead need the reachable public address:
pasv_address=203.0.113.10Replace the example with the actual public address or DNS-resolved address that clients can reach. Do not set this line merely because passive mode is enabled. An incorrect value is worse than an omitted one: the client connects to the address in the PASV response, so a private or stale address produces a successful login followed by failed listings or transfers.
Validate and reload vsftpd
After saving the file, restart or reload the daemon using the service name present on your system:
sudo systemctl restart vsftpd
sudo systemctl status vsftpd --no-pagerCheck the status output for syntax errors or a failed start. A firewall rule cannot compensate for a daemon that is not listening or that ignored the intended settings.
Add the iptables rules
Inspect existing policy and avoid duplicates
Run the inspection commands before adding anything. If an ESTABLISHED,RELATED rule and the required port rules already exist, do not append duplicates. Pay attention to the INPUT chain’s default policy and to earlier REJECT or DROP rules: iptables evaluates rules in order.
Representative IPv4 rule pattern
For a host whose policy permits these appended rules, the common pattern is:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 21 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 30000:31000 -j ACCEPTThe first rule allows packets belonging to connections already tracked by the kernel, including data flows classified as related to an FTP control session. The second permits the control connection. The third must exactly match pasv_min_port through pasv_max_port.
These commands are a pattern, not a complete firewall policy. Put equivalent rules in the chain and position required by your site’s existing policy. If possible, restrict the source of port 21 and the passive range to known client networks rather than allowing every IPv4 address:
Recommended Free Tools
sudo iptables -A INPUT -p tcp -s 198.51.100.0/24 --dport 21 -j ACCEPT
sudo iptables -A INPUT -p tcp -s 198.51.100.0/24 --dport 30000:31000 -j ACCEPTUse a source restriction only when clients have predictable addresses. Public users, roaming staff, or third-party integrations may require a broader source policy.
Persist the rules with the owning manager
Runtime iptables rules are not automatically a durable configuration on every Ubuntu installation. Save them using the firewall manager that owns the host, and verify that the same manager restores them after reboot. Do not simultaneously maintain UFW, direct iptables commands, and native nftables rules unless you deliberately understand their interaction; Ubuntu’s nftables guidance warns that competing managers can overwrite each other’s rules.
Account for NAT, cloud firewalls, and perimeter devices
Every network layer between the FTP client and server must permit the same traffic. If the server has a private address behind a router, forward TCP 21 and every port in the passive range to that private address. If a cloud security group or perimeter firewall sits in front of Ubuntu, create matching inbound rules there as well.
The address in pasv_address must be the address clients can actually reach. The forwarding target, daemon range, host firewall range, and advertised address form one configuration; changing only one element commonly creates the login-works-but-listing-fails symptom.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
| Deployment | Required control path | Required data path | Typical extra concern |
|---|---|---|---|
| Public Ubuntu host | TCP 21 to the host | Configured passive range to the host | Cloud or perimeter rules may still apply |
| Ubuntu host behind NAT | TCP 21 forwarded to the host | Entire passive range forwarded to the host | Set pasv_address to the reachable public address when required |
| Restricted client network | TCP 21 allowed from client addresses | Passive range allowed from client addresses | Source restrictions must include every legitimate client |
Connection tracking and FTP helpers
Linux connection tracking records flow state. The ESTABLISHED,RELATED rule is intended to accept packets that belong to an existing connection or are recognized as related to one. Some deployments also require an FTP conntrack helper so the kernel can classify related FTP data flows.
Helper assignment is not uniform across Ubuntu releases, kernel settings, nftables configurations, and encrypted FTPS traffic. Do not copy a helper command as if it were universal. Instead, inspect the active conntrack and helper behavior on the specific system. A port-21 rule alone does not prove that the data connection will be marked RELATED.
sudo conntrack -L
sudo iptables -L INPUT -n -v --line-numbersIf the conntrack utility is installed, look for the control flow and the attempted data flow while reproducing the failure. Packet capture can show whether the client is reaching the advertised address and port:
sudo tcpdump -ni any 'tcp port 21 or (tcp portrange 30000-31000)'Adjust the capture range to your actual configured values. The goal is to distinguish a client that never receives a usable PASV response, a packet blocked before Ubuntu, and a packet dropped by the host firewall.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchTest the complete passive path
- Restart or reload vsftpd. Confirm the service is active and listening on TCP 21.
- Connect with an FTP client. Authenticate, then request a directory listing. A login test alone exercises only the control connection.
- Perform both directions of transfer. Try a download and an upload if the account has permission. Different policies can expose one direction while hiding another failure.
- Read the PASV or EPSV response. Record the advertised address and port. Confirm the port falls inside your configured range and that the address is reachable from the client network.
- Observe the firewall counters. Re-run
iptables -L INPUT -n -vwhile testing. Counters on port 21 but not on the passive-range rule indicate that the data connection may be going elsewhere or being stopped upstream. - Capture traffic when necessary. Use tcpdump or conntrack inspection to determine whether the data flow reaches Ubuntu and whether it is tracked as related.
Troubleshoot the “login works, listing hangs” failure
The PASV address is private, stale, or otherwise unreachable
Inspect the server’s PASV reply. If it advertises an RFC1918 address while the client is outside that private network, configure pasv_address with the reachable public address and ensure NAT forwards the passive range. If the server’s public address changes, update the setting and reload vsftpd.
The passive port is outside the firewall allow-list
Compare the port in the PASV reply with pasv_min_port and pasv_max_port. Then compare those values with the INPUT rule, cloud security group, and perimeter firewall. A mismatch of even one range boundary can affect only some transfers.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
NAT forwards port 21 but not the data range
Forwarding the control port is insufficient. Create a destination-NAT or port-forward rule for the complete passive range, not just the first port observed during one test. Keep the forwarding range synchronized with vsftpd and the host firewall.
A DROP rule or wrong chain order wins first
Use numbered rule output to find earlier DROP or REJECT entries. iptables stops evaluating a packet when a terminating rule matches. Place the established/related and FTP rules where they are effective under the site’s policy rather than blindly appending them.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →A different manager removed or bypassed the rule
Check whether UFW or native nftables is active, and inspect both the configured policy and the live ruleset using that manager. Do not keep editing direct iptables rules if another service restores a different policy at boot or on reload.
Related traffic is not being classified
Inspect conntrack state during a transfer. If the data flow is not recognized as related, investigate the helper configuration for your Ubuntu release and whether encryption changes what can be inspected. Avoid assuming that an FTP helper is active merely because TCP 21 is open.
Compare the main design choices
| Choice | Advantage | Cost or risk | Best fit |
|---|---|---|---|
| Narrow passive range | Fewer exposed ports and simpler allow-lists | Less room for simultaneous data sessions | Small, predictable client population |
| Broad passive range | More potential concurrent sessions | Larger firewall and NAT exposure | Higher-concurrency service with a deliberate policy |
| Direct public hosting | No address translation or port-forward layer | Host is directly exposed to the Internet | Servers with strong perimeter and host controls |
| Hosting behind NAT | Private server addressing | Requires complete forwarding and correct advertised address | Networks that already centralize inbound routing |
| Direct iptables commands | Immediate, precise rule changes | Rules may be lost or conflict with the owning manager | Administrators who control persistence and backend selection |
| UFW or native nftables ownership | One coherent policy and persistence model | Syntax and inspection differ from raw iptables | Hosts standardized on that manager |
Passive FTP does not make file transfer secure
Opening the passive range solves reachability, not confidentiality. Ubuntu’s FTP guidance states that FTP credentials and data are sent in clear text and points readers to OpenSSH documentation for secure file transfer.
FTPS is FTP protected with TLS; SFTP is a different file-transfer protocol that runs over SSH. They have different daemon settings, firewall behavior, and client requirements. If credentials or file contents must be protected from interception, choose an encrypted protocol rather than treating passive-port rules as a security control.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Final verification checklist
- vsftpd has
pasv_enable=YES. pasv_min_portandpasv_max_portdefine a deliberate, matching range.- vsftpd was restarted or reloaded after editing.
- TCP 21 is allowed at Ubuntu and every upstream firewall.
- The entire passive range is allowed at Ubuntu and every upstream firewall.
- NAT forwards TCP 21 and the complete passive range to the FTP host, when NAT is present.
pasv_addressis set only when needed and contains an address reachable by clients.- The established/related rule is effective in the correct chain and order.
- Conntrack/helper behavior has been checked rather than assumed.
- Only one firewall manager owns the active policy.
- A real directory listing, upload, and download have been tested.
- You have selected FTPS or SFTP when clear-text FTP is not acceptable.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
