Running a Google Compute Instance. For legacy reasons, I need to use FTP as a client (not a server) to access other peoples' FTP servers.

I have tried "passive" mode, with no results:

instance-1:~$ ftp -p   <--- note –p option for passive mode
Connected to
220 (vsFTPd 3.0.3)
Name ( username
FTP server
331 Please specify the password.
230 Login successful.              <--- note successful login
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (123,123,123,123,21).
(system hangs at this point, for about 1-2 minutes)
ftp: connect: Connection timed out

(IP address & username redacted)

Attempting get filename.ext on a known file also fails.

If I try to use non-passive mode, I get the following error immediately:

230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
500 Illegal PORT command.
ftp: bind: Address already in use

Any thoughts? I've tried opening up ports 20 & 21 for ingress, and I assume egress ports are available.

Please no need to comment on the security aspects or on alternatives such as SFTP. This is an automated data collection process for several hundred servers, so it's not practical to ask legacy customers to switch to SFTP or a more secure API, and the data being transferred is not sensitive anyway.

Thanks in advance for any help!


For non-passive mode you have to "rewrite" the PORT command IP packet sent to the server (it contains the internal IP address and not the public one). See my temporary solution for google cloud here.


There might be the same root cause as here, a range of higher ports should be opened if you are connecting in Passive mode.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.