FileZilla Server ports: which ones to open, and why

FileZilla Server needs TCP 21 open for the control connection, plus a passive port range that you choose yourself. 50100-51100 is a sensible default. Passive mode is what your client uses unless you tell it otherwise, and without that range open you get a connection that logs in fine and then times out on the first directory listing.

The range is yours to pick. It does not have to be 1000 ports wide; a few hundred is plenty unless you run a lot of parallel transfers. What does matter is that the range you configure in FileZilla Server and the range you open in the firewall are exactly the same.

Why passive mode needs a port range at all

FTP uses two connections: one for commands and one for the actual data. In passive mode the server picks a port for that second connection, tells the client about it in the 227 Entering Passive Mode response, and waits for the client to connect there. Clients default to passive mode because it works through the firewall on their own side.

Without a configured range the server picks any port between 1 and 65535. Opening 65,000 ports in your firewall is not an option, so you limit FileZilla to a narrow range and open only that.

This is what you see if you skip that step:

Response:  227 Entering Passive Mode
Command:   LIST
Error:     Connection timed out
Error:     Failed to retrieve directory listing

Login works and the control channel is fine, and then nothing happens. That points at the data channel, and usually at the passive range.

Step 1: set the passive port range in FileZilla Server

FileZilla Server 1.0 and newer. The interface changed completely in 1.0, so older instructions you find elsewhere no longer match:

1. Open the FileZilla Server administration interface and connect to your server.
2. Go to Server > Configure...
3. In the tree on the left, open FTP and FTPS (under Protocols settings).
4. Find Passive mode, tick Use custom port range, and enter 50100 and 51100.
5. Click OK.

FileZilla Server 0.9.x, legacy but still out there on older machines:

1. Open the FileZilla Server GUI.
2. Edit > Settings.
3. Select Passive mode settings in the tree.
4. Tick Use custom port range and enter 50100 and 51100.
5. Click OK.

If you are still on 0.9.x: that branch has been end of life for years and has known security issues. Upgrading to 1.x is the better fix.

Step 2: tell the server its external IP, if it sits behind a router

Most guides leave this out, and it produces the same timeout as a closed firewall.

In the 227 Entering Passive Mode response the server sends its own IP address. A server behind NAT will hand out its private address, something like 192.168.1.50, and a client on the internet will try to connect to that and get nowhere.

In the same passive mode settings you can set the external IP address to your public IP, or let FileZilla retrieve it automatically if your public IP changes. On the router, forward both port 21 and the full passive range to the server.

You can recognise this one by the symptom: it works from inside the office and times out from everywhere else.

Step 3: open the ports in the Windows firewall

The quick way, in an elevated PowerShell:

New-NetFirewallRule -DisplayName "FTP Control - FileZilla" `
  -Direction Inbound -Protocol TCP -LocalPort 21 -Action Allow

New-NetFirewallRule -DisplayName "Passive FTP Ports - FileZilla" `
  -Direction Inbound -Protocol TCP -LocalPort 50100-51100 -Action Allow

Or through the interface, if you prefer to see what you are doing:

1. Press Win + R, type firewall.cpl and press Enter. You can also hit Start and type firewall until Windows Defender Firewall with Advanced Security shows up.
2. Select Inbound Rules in the tree.
3. Click New Rule... in the right-hand panel.
4. Choose Port and click Next.
5. Select TCP and enter 50100-51100 under Specific local ports.
6. Choose Allow the connection and click Next.
7. Pick the profiles the rule applies to (Domain, Private, Public).
8. Give it a name you will recognise later, such as Passive FTP Ports - FileZilla.
9. Click Finish. Repeat for port 21 if you have not already.

This works the same on Windows Server 2012 R2 through 2025 and on Windows 10 and 11. The firewall interface has barely changed.

A note on FTPS

Windows Firewall has a stateful FTP inspector that can open data ports on the fly by reading the control channel. It is enabled by default, and it explains why plain FTP sometimes works without any of the above.

Once you enable FTPS that stops working. The control channel is encrypted, the firewall cannot read it, and it has no way of knowing which data port to open. So if you use TLS, and you should, opening a passive range explicitly is not optional.

Verifying

A working passive connection looks like this:

Response:  227 Entering Passive Mode
Command:   LIST
Response:  150 Connection accepted
Response:  226 Transfer OK
Status:    Received file listing

To test the data ports in isolation, from another machine:

Test-NetConnection -ComputerName ftp.example.com -Port 50100

TcpTestSucceeded : True means the firewall and the router are doing their job, and anything still broken is in FileZilla's own configuration.

Troubleshooting

Originally written in 2014 for Windows Server 2012. Updated in 2026 for FileZilla Server 1.x and current Windows Server releases.