I have an OpenSuSE box running vsftp. It is behind a firewall at our hosting company. They control the firewall, I have no access to it. It has unrestricted access from our VPN via 10.x.x.x, and ports 20, 21, 40000-40500 on public IP address 41.x.x.x are forwarded to it.

From our VPN, everything works fine. However, from outside, I'm having issues. When the client switches to Passive mode, the server responds with

227 Entering Passive Mode (10,x,x,x,,157,213)

In Filezilla, I get the message:

227 Entering Passive Mode (41,x,x,x,228,63)

I've worked the ports out to be 40248 and 58203, respectively. In my vsftpd.conf file, I have the lines:



# pasv_address=10.x.x.x

Which corresponds with the ports that I'm forwarding.

After switching to Passive mode, the client get no further response from the server. I suspect it's because it's trying to connect to an IP address that it can't access, on a port which is not forwarded to the server, and the server is not listening for a connection on that port.

I've tried changing


in the config file, but all that it achieves is breaking the connection from the VPN. As soon as the connection originates on 41.x.x.x, the ports do not match.

What do I need to change in my config to make this work?


Based on the IP also being different between the server and client logs, I would suspect that the firewall is intercepting the connection and attempting to NAT it or something (although it should still work if the firewall is doing this correctly). Can you try connecting with SSL/TLS so that the firewall doesn't mess with the control connection?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.