FTP connection errors on a DirectAdmin server are one of the most frustrating problems web hosting customers encounter. The connection appears to start, then stalls or refuses entirely — usually with errors like ECONNREFUSED, Could not retrieve directory listing, or Connection timed out after passive mode failed. This guide covers every root cause behind DirectAdmin FTP not working, from passive port misconfiguration and firewall blocks to NAT/IP address mismatches and ProFTPd vs Pure-FTPd differences.
1. Understand Active vs Passive FTP Mode
Before troubleshooting, you need to understand which FTP mode is failing. Active and passive mode have completely different connection flows, and your firewall needs different rules for each.
- Active mode: The server connects back to the client's port. This almost always fails through NAT firewalls and is not recommended for modern use.
- Passive mode (PASV): The client connects to a random high port on the server that the server opens. This requires a defined port range to be open in your firewall.
Most FTP clients (FileZilla, WinSCP, Cyberduck) default to passive mode. If you see PASV in the connection log before the error, you have a passive mode problem.
Check which FTP daemon DirectAdmin is running
ps aux | grep -E "pureftpd|proftpd" | grep -v grepDirectAdmin installations typically use either Pure-FTPd or ProFTPd. The fix differs slightly between them.
💡 None of these worked? Skip the guesswork.
Get Expert Help →2. Check the Passive Port Range Configuration
The most common cause of passive FTP failures on DirectAdmin is that the passive port range is not defined in the FTP daemon's configuration — or it is defined but not opened in the firewall.
For Pure-FTPd:
grep -i "PassivePorts\|PassivePortRange" /etc/pure-ftpd.conf /etc/pure-ftpd/conf/PassivePorts 2>/dev/nullYou should see a range like 35000 35999. If this file or setting is missing, passive connections will use random ports that your firewall will block.
echo "35000 35999" > /etc/pure-ftpd/conf/PassivePorts
# or edit /etc/pure-ftpd.conf and add:
PassivePortRange 35000 35999systemctl restart pure-ftpd
# or:
service pure-ftpd restartFor ProFTPd:
grep -i "PassivePorts" /etc/proftpd.conf /etc/proftpd/proftpd.conf 2>/dev/nullgrep -q "PassivePorts" /etc/proftpd.conf || echo "PassivePorts 35000 35999" >> /etc/proftpd.confsystemctl restart proftpdEdit /etc/csf/csf.conf and find the TCP_IN setting. Add the passive port range:
grep "TCP_IN" /etc/csf/csf.conf | head -3Add 35000:35999 to the TCP_IN list:
sed -i 's/^TCP_IN = "/TCP_IN = "35000:35999,/' /etc/csf/csf.confOr edit the file directly and append 35000:35999 to the comma-separated list.
csf -rIf using iptables directly:
iptables -I INPUT -p tcp --dport 35000:35999 -j ACCEPT
service iptables save
# or:
iptables-save > /etc/iptables/rules.v4Verify the ports are now open:
iptables -L INPUT -n | grep "35000"hostname -I # internal IP(s)
curl -s ifconfig.me # public/external IPecho "YOUR_PUBLIC_IP" > /etc/pure-ftpd/conf/ForcePassiveIPReplace YOUR_PUBLIC_IP with the actual public IP from the curl command above.
Add this to /etc/proftpd.conf:
MasqueradeAddress YOUR_PUBLIC_IP
PassivePorts 35000 35999systemctl restart pure-ftpd
# or:
systemctl restart proftpdsystemctl status pure-ftpd
# or:
systemctl status proftpdIf stopped, start it:
systemctl start pure-ftpd && systemctl enable pure-ftpdss -tlnp | grep ":21"grep "^TCP_IN" /etc/csf/csf.conf | grep -o "21[^0-9]"
# or:
iptables -L INPUT -n | grep " 21 "ftp localhost 21You should receive a 220 banner from the FTP daemon. Type quit to exit.
Log in to DirectAdmin > FTP Management and confirm the FTP account is listed with the correct home path.
In DirectAdmin > FTP Management, click the FTP account and set a new password. Update this in your FTP client.
grep "your-ftp-username" /etc/passwdls -la /home/username/domains/yourdomain.com/public_html/The directory must exist and be readable by the FTP user. If it was deleted or has wrong ownership, FTP logins will succeed but directory listing will fail.
echo "1" > /etc/pure-ftpd/conf/TLS
echo "2" > /etc/pure-ftpd/conf/TLSCipherSuiteopenssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem -subj "/CN=ftp.yourdomain.com"
chmod 600 /etc/ssl/private/pure-ftpd.pemsystemctl restart pure-ftpdIn FileZilla, change the Protocol to FTP and Encryption to Require explicit FTP over TLS.
For persistent FTP connectivity issues across multiple DirectAdmin server accounts, CloudHouse's DirectAdmin managed support team can audit your FTP daemon configuration, firewall rules, and passive port setup — and fix it in a single session.
