Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Whenever I install vsftpd on centos, I only setup the jail environment for the users and rest is default configuration of vsftpd. I create user and try to connect with filezila ftp client but I could not connect with passive mode. I always change the "transfer settings" to active mode to successfully connect to the ftp server otherwise I get

 Error: Failed to retrieve directory listing

So is there a way to change any directive in vsftp.conf file and we can connect with passive mode to the server?

Update: Thanks to all working well with the answers given.

share|improve this question
up vote 54 down vote accepted

To configure passive mode for vsftpd you need to set some parameters in vsftpd.conf.


This enables passive mode and restricts it to using the eleven ports for data connections. This is useful as you need to open these ports on your firewall.

iptables -I INPUT -p tcp --destination-port 10090:10100 -j ACCEPT

If after testing this all works then save the state of your firewall with

service iptables save

which will update the /etc/sysconfig/iptables file.

To do this is CentOS 7 you have to use the new firewalld, not iptables:

Find your zone:

# firewall-cmd --get-active-zones
  interfaces: eth0

My zone is 'public', so I set my zone to public, add the port range, and after that we reload:

# firewall-cmd --permanent --zone=public --add-port=10090-10100/tcp
# firewall-cmd --reload

What happens when you make a connection

  • Your client makes a connection to the vsftpd server on port 21.

  • The sever responds to the client telling it which port to connect to from the range specified above.

  • The client makes a data connection on the specified port and the session continues.

There is a great explanation of the different ftp modes here.

share|improve this answer
Wondering why you put the max port after the min... but more importantly, if you open ports 10090 to 10100, that's 11 ports and not 10 as you say. – Alexis Wilke Nov 6 '15 at 7:41
I believe it's alphabetical, it really doesn't matter as they are separate directives. – Iain Nov 6 '15 at 7:52
This is not working for me without pasv_address. – fbmd Nov 30 '15 at 22:12
took me ages to find this, none of the vsftpd guides list this... brilliant – Willshaw Media Jun 13 at 11:37

To enable passive mode, set the following configuration options in your vsftp.conf:


You can of course change the start and end port, and should replace the xxx's with the public IP of your server.

In addition, you should open the passive mode port range in your firewall. On centos, you can load the ip_conntrack_ftp module to handle ftp connections in your firewall. Edit /etc/sysconfig/iptables-config and add ip_conntrack_ftp to the IPTABLES_MODULES option. Afterwards restart iptables:

/sbin/service iptables restart
share|improve this answer
pasv_address is what does the trick when everything else has been set up and it still doesn't work. – fbmd Nov 30 '15 at 22:12

Beside the pasv_enable=YES, specify a port range in which VSFTP will run PASV mode:


Don't forget to configure iptables allows packet transmission on these ports:

iptables -I INPUT -p tcp --dport 50000:50999 -j ACCEPT
share|improve this answer
On a standard CentOS system there is a blanket DROP that causes rules added with iptables -A INPUT ... to be ignored – Iain Aug 25 '12 at 16:59

Usually, it's not the ftp server, vsftpd, but the firewall like iptable that prevents passive mode from being used (blocking tcp connection needed for data transfert).

share|improve this answer
Actually, vsftpd could be smart enough to open a port in the firewall... but from the answers I see here, it does not look like it's capable of such a feat. – Alexis Wilke Nov 6 '15 at 7:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.