FileZilla Passive Mode and Windows Firewall
Understand FileZilla passive mode on Windows and fix directory listing failures, timeouts and blocked FTP data connections without random firewall changes.
Why FTP needs more than one connection
Classic FTP uses a control connection for commands and a separate data connection for directory listings and file transfers. That second connection is why a login can succeed while the folder list still times out. SFTP does not use this two-channel FTP model, so passive-mode troubleshooting applies to FTP and FTPS rather than SFTP.
What passive mode changes
In passive mode the client opens both the control and data connections. This is usually friendlier to home routers, office NAT and Windows firewall rules than active mode, where the server attempts a connection back to the client. FileZilla therefore works best in passive mode for most client-side internet connections.
Recognize a passive-mode problem
Typical symptoms include a successful login followed by a directory listing that hangs, data connection timeouts, or transfers that start inconsistently. Read the message log before changing settings. If authentication itself fails, passive mode is not the first thing to investigate.
Check Windows Firewall without disabling it
Do not solve FTP problems by permanently turning off Microsoft Defender Firewall. Instead confirm that FileZilla is allowed for the network profile you are actually using and that security software is not blocking its outbound data connections. On managed PCs, firewall policy may be controlled by an administrator and local changes can be ignored.
Server-side passive port ranges
When you control the FTP server, the server must advertise a usable passive address and a passive port range that is allowed through its firewall and NAT device. A client cannot repair a server that advertises a private address or has its passive ports blocked upstream. Hosting users should ask the provider for the correct FTP or FTPS connection guidance rather than guessing ports.
FTPS adds another layer
Explicit FTPS begins on the normal FTP control port and then negotiates TLS. Some older firewalls and NAT helpers cannot inspect encrypted FTP traffic correctly, which can expose configuration mistakes that plain FTP seemed to hide. Prefer a correctly configured passive range rather than relying on protocol inspection features in a router.
When to choose SFTP instead
If the server supports SFTP, it is operationally simpler through firewalls because the session normally uses one SSH connection. That does not make FTP or FTPS wrong, but it can reduce NAT complexity. Use the protocol the server is designed to provide and avoid changing production services only to work around a local client issue.