We have to use FTP over SSL on our server and use a portrange with 5 ports for the data connection. A firewall is between client and server. We have to know what we have to open at the firewall: port, protocoll, in- or outcomming. Does anybody know this?

  • What OS are you using?
    – Sam Cogan
    Aug 5, 2009 at 11:23
  • I will not configure the firewall by myself, I only have to assign what have to be opened. So I don't know wich OS the firewall is.
    – Queensheep
    Aug 5, 2009 at 12:07

5 Answers 5


Slacksite has a good explanation of how FTP operates in active vs. passive mode, and definitive information on the data connection behaviour is in RFC 4217, § 7.

Basically, assuming your clients use passive mode and explicit SSL (e.g. connects on control port 21 instead of 990 for implicit SSL), you would need to allow incomming connections to the control port 21 and your 5 data ports from any clients high port range to the server, and outgoing established connection packets from the respective ports to random high ports. Active FTP is normally not a good idea as server will try to actively open a connection to the client, which most client side stateful firewalls will not allow if not configured accordingly.

  • tools.ietf.org/html/rfc4217#page-8 - here is the RFC link
    – VolkA
    Aug 5, 2009 at 12:43
  • So if I want to use passive mode and implicit SSL, there will be used port 990 in and out (I suppose with TCP) and then for the data connection the port range also in and out (also with TCP). So the firewall does not to be opened for UDP?
    – Queensheep
    Aug 5, 2009 at 14:05
  • 1
    Yes, the data connections also use TCP, so it should be sufficient to open up all data ports + the control port. Note that the implicit port is reserved, but not yet defined in the RFC. Thus it might be better to also open the normal control port and block non encrypted connections in the FTP Server configuration.
    – VolkA
    Aug 5, 2009 at 14:42

Yes, FTPS has big issues in terms of port use. It retrofitted encryption on a protocol, FTP, that was designed for a network without firewalls and black hats.

However SFTP has significant performance issues with large files and high latency (or long distance) connections. So as bandwidth improvements allow larger file transfers, SSH/SFTP's limitations become more significant and FTPS is the only other alternative.

  • 'FTPS is the only other alternative' what about HTTPS? Jul 23, 2020 at 16:34

Usually, explicit "active" FTPS is port 990 and the control port is 989. Passive is the same as active but just means that in addition to 989 you use a few ports over the 1024+ range open on the server (for the client to initiate data connection), depending on how you configured your server.

Personally I prefer to use NULL FTP Server, run a implicit SFTP on port 22, and just have single port implementation.


Use wireshark http://www.wireshark.org/ and a host outside the firewall to see what ports are used by this particular FTP+SSL configuration.

Based on the traffic you see, create firewall rules to allow that kind of traffic from the IP address of FTP server.


The problem with FTPS is that all the workarounds which firewalls have implemented to handle the FTP protocol weirdness work no more. This is because the firewall can't inspect the encrypted connection to dynamically open the required ports.

That said: The port range that you have configured for passive FTP in the server software needs to be opened from the client to the server. Also, the client needs to know that it must use passive mode. I've had my first FTPS deployment in the past weeks and it works exactly like that.

(What is it with the renaissance of FTPS lately? FTP is an archaic 1970s nightmare of a protocol and, for the sake of humanity, people should really stay away from it, encrypted or not.)

  • So what is the solution for the asker?
    – LaTeX
    Mar 1, 2011 at 2:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy