227 entering passive mode ошибка при попытке ftp

The File Transfer Protocol is a network protocol providing functionality for file access, file transfer, and file management.

In addition, FTP operates in either active or a passive mode.

Due to the wrong passive port range configuration settings on the server side, the customer may cause an error like,

"227 Entering Passive Mode (192,168,1,2,118,151).
ftp: connect: Connection timed out"

Today, we’ll see the reason for this error and how it is fixed by our Support Engineers as part of our Server Management Services.

Active and Passive modes?

In passive mode, the server decides which server-side port the client should connect to. Then the client starts the connection to the specified port.

On the other hand, in active mode, the client specifies which client-side port the data channel has opened and the server starts the connection.

Moreover, one of the main reason to occur this “227 entering passive mode FTP connect connection timed out” error is the improper configuration settings of the passive port range.

How we fixed 227 entering passive mode FTP connect connection timed out error

The error is caused due to the misconfiguration of the passive port range on the FTP server and in the firewall settings.

Therefore, our Support Engineers correct the settings in both FTP server and in the firewall.

Set passive port range in FTP server

CPanel offers a choice of two FTP servers. PureFTP and ProFTP. PureFTPd is very much secure.

Here, our Support Engineers took the following steps to add passive range port on Pureftp servers.

In Pureftpd,

To solve the error, the passive Port range should be added to the Pureftp configuration file.

1. We open Pureftp configuration file  /etc/pure-ftpd.conf.

2. Then, we add the following line.

PassivePortRange 30000 35000

3. At last, we restart the Pureftp service.

service pureftpd restart

In ProFTP,

In ProFTP,  we add the passive port range in /etc/proftpd.conf.

1.  We open /etc/proftpd.conf and add this line.

PassivePorts    30000 35000

2. In the end, we restart the service.

service proftpd restart

Add passive port range in firewall settings

Most servers have a firewall to avoid security problems. Therefore, the passive port range should be open in the firewall configuration too.

Even if the FTP server allows passive ports, the firewall can block the connection between FTP client and server when the passive port range is not open. It results in 227 entering passive mode ftp connect connection timed out error.

Our Support Engineers use the following steps to add the passive port range to the firewall configuration file.

For firewall like Iptables,

1. Firstly, we open /etc/sysconfig/iptables file.

2. Then, we add the entry like,

iptables -I INPUT -p tcp --dport 49152:65534 -j ACCEPT

3. At last, we restart iptables

service iptables save

For firewall like CSF,

1. We open /etc/csf/csf.conf file.

2. Then, find the line with TCP_IN ,TCP_OUT and then added the port range.

# Allow incoming TCP ports
TCP_IN = "20,21,22,25,53,80,110,30000:35000"

TCP_OUT = "20,21,22,25,53,80,110,30000:35000"

3. Finally, restart the CSF service.

csf -r

service csf restart

[Getting 227 entering passive mode ftp connect connection timed out error? We’ll fix it for you.]

Conclusion

In short, the improper configuration of the passive port range in the FTP server and in the firewall configuration file are the main reasons for “227 entering passive mode ftp connect connection timed out” error. Today, we saw how our Support Engineers fixed this error.

var google_conversion_label = «owonCMyG5nEQ0aD71QM»;

Доброго времени суток. Собственно, сабж в титле.

Сама ошибка выглядит по меньшей мере непонятно:

«Удаленный сервер возвратил ошибку: 227 Entering Passive Mode
(192,168,1,136,39,43)»

при чём тут ошибка? мне же и нужно в пассивный режим зайти… ладно, едем дальше.

Опыта работы с ftp нет, нашел какие то исходники, собрал проект, выдаётся вышеупомянутое исключение. Упростил код до невозможности, ошибка осталась. Странность ещё в том, что в totalCommander соединение удаётся,

    private void btn_connect_Click_2(object sender, RoutedEventArgs e)
    {
        FtpWebRequest requestDir = (FtpWebRequest)FtpWebRequest.Create("ftp://192.168.1.136/");
        requestDir.Credentials = new NetworkCredential("username", "password");
        requestDir.Method = "LIST";
        requestDir.UseBinary = true;
        requestDir.EnableSsl = false;
        requestDir.UsePassive = true;

        try
        {
            WebResponse response = requestDir.GetResponse();
        }
        catch (Exception ex)
        {
            MessageBox.Show(ex.ToString() + ": n" + ex.Message);
        }
    }

пробовал так же ставить

requestDir.UsePassive = false;

Получил ошибку 500, синтаксическую, мол, команда не опознана.
Буду благодарен, если мне объяснят, что я делаю не так)

Moderator: Project members

As said in the title, I don’t manage to connect my Windows 10 host to my FTP server on the VirtualBox guest side (Ubuntu 18.04).
On the guest side, the vsftpd server works fine, I can connect without any problem.

So I tried to forward the associated port to the host (NAT) and tried to connect to the server via FileZilla. It does login, but always fails to retrieve directory listing. I tried deactivating the firewalls, giving all the access permissions to the folder but it doesn’t change anything.

I read that it could be a problem of passive mode there:
Problems with FTP file access to VirtualBox guest running Windows 2008 Server R2 x64

So I added the following lines to my vsftpd.conf:

pasv_enable=YES
pasv_min_port=8020
pasv_max_port=8020
port_enable=YES
pasv_address=127.0.0.1

I forwarded the port 8020 but I now get the following error on FileZilla:

The data connection could not be established: WSAEADDRNOTAVAIL — Cannot assign requested address

Full FileZilla response:

Status: Connecting to 127.0.0.1:2100...
Status: Connection established, waiting for welcome message...
Status: Server does not support non-ASCII characters.
Status: Logged in
Status: Retrieving directory listing...
Command:    PWD
Response:   257 "/home/cakephp" is the current directory
Command:    TYPE I
Response:   200 Switching to Binary mode.
Command:    PASV
Response:   227 Entering Passive Mode (0,0,0,0,31,84).
Command:    LIST
Error:  The data connection could not be established:
WSAEADDRNOTAVAIL - Cannot assign requested address
Error:  Connection timed out after 20 seconds of inactivity
Error:  Failed to retrieve directory listing
Status: Disconnected from server

I’m a bit lost with this, does anybody have a suggestion?
Thanks in advance

EDIT1:
Without any kind of hope, I also tried to access from the Windows Command Prompt. It does connect but when I ls the current folder I get the following error:

500 illegal PORT command.
425 use PORT or PASV first.

But I guess that this is because ftp.exe doesn’t support passive mode.

Just in case it can help, you can find here my whole current vsftpd config file.
Also, I can seamlessly access to the guest SSH server from the host with Putty.

EDIT2:
I set listen_ipv6 to YES, changed pasv_max_port to 8030 to increase the number of passive ports and forwarded them. I get the following logs from FileZilla:

Status:  Connecting to 127.0.0.1:2100...
Status: Connection established, waiting for welcome message...
Status: Server does not support non-ASCII characters.
Status: Logged in
Status: Retrieving directory listing...
Command:    PWD
Response:   257 "/home/cakephp" is the current directory
Command:    TYPE I
Response:   200 Switching to Binary mode.
Command:    PASV
Response:   227 Entering Passive Mode (0,0,0,0,31,90).
Command:    LIST
Error:  The data connection could not be established: WSAEADDRNOTAVAIL - Cannot assign requested address
Error:  Connection timed out after 20 seconds of inactivity
Error:  Failed to retrieve directory listing