I'm setting up a secure FTP server on an Ubuntu 16.04 machine on Azure. It's FTP over TLS, with anonymous access disabled.

Trying to use the server using Filezilla works fine - authentication, transfer, directory listing - everything... except I get the following warning from Filezilla:

Server sent passive reply with unroutable address. Using server address instead.

Sure, that makes sense - the VM has a private IP address, and in passive mode, it sends that private IP address to the client. The solution - add the following to vsftp.conf (this is an example, not the actual configuration):

#The VM allows connections to ports 12345 & 12346 - remember, this is an example
#The VM's domain name
#Make vsftp resolve myftpservervm.cloudapp.net and send that IP address to clients

Then I restart vsftp, and... nothing happens. I still get these:

Server sent passive reply with unroutable address. Using server address instead.

I even tried setting pasv_address to the exact (external) IP address of the server (with and without pasv_addr_resolve=YES) and the result is the same.

Am I missing something?

I'm using vsftpd 3.0.3 (from the Ubuntu repo) with Filezilla 3.24.0 on Ubuntu 16.04 x64


Apparently vsftp sends an IP address of when entering passive mode. This issue seems relevant.


I test in my lab, at first I met the same problem as you. I checked as the following steps:

1.netstat -ant I get the following result

tcp6       0      0     TIME_WAIT  

Based on my experience, ftp should be listening on tcp not tcp6 on Azure VM

2.I try to change the configuration file /etc/vsftpd.conf.


Then I restart ftp service and check by using netstat -ant

tcp        0      0    *               LISTEN  
  1. Test by using Filezilla.

enter image description here

Notes: You should open ports 20,21,12345-12346 on Azure NSG(Inbound rule)

| improve this answer | |

You need just a minor modification. Edit /etc/vsftpd.conf or whatever the config file might be, and do this change:


Save the file, restart the vsftpd service and check again!

Be sure that hose passive ports are in the tcp allow list in your Security Groups (you can configure those from your AWS EC2 Dashboard).

| improve this answer | |
  • That's exactly what I did. I tried both the external IP, and the domain name (with pasv_addr_resolve=YES). It produced the same result. – Malt Feb 6 '17 at 15:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.