This question already has an answer here:

I've configured FileZilla server successfully (without SSL/TLS) by port forwarding:

-Modem (external ISP address): TCP 21, 990, 50000-50100 ->

-Router (external TCP 21, 990, 50000-50100 -> (server)

And allowing Windows Firewall TCP(and UDP) ports 21, 990 and 50000-50100. I also set FileZilla server to use a custom port range for passive mode (50000-50100)


As soon as I enable the following checkboxes in FileZilla server:

  • Enable FTP over SSL/TLS support (FTPS)
  • Allow explicit FTP over TLS
  • Disallow plain unencrypted FTP
  • For PROT P to encrypt file transfers in SSL/TLS mode

The connection is made (accept the certificate), but the client fails at the MLSD command after entering passive mode.

Does explicit SSL/TLS use different ports? If I try implicit SSL (port 990) the connection isn't even made. I would settle for either type of secure connection working.

marked as duplicate by MadHatter, MichelZ, Wesley, Andrew, EEAA Apr 17 '14 at 5:21

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


Your explicit connection is likely being killed by stateful packet inspection (SPI) or deep packet inspection (DPI) of your router. You should be able to disable that and/or add an exception for the MLSD command.

Your implicit connection needs TCP 989 for the data channel.

  • I don't think my router (WRT54G) has SPI, nor the modem. I also opened TCP 989 on modem, router and server. The implicit connection still hangs (doesn't ever connect) – David Fox Jan 7 '12 at 14:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.