FTP connection errors on a DirectAdmin server are one of the most frustrating problems web hosting customers encounter. The connection appears to start, then stalls or refuses entirely — usually with errors like ECONNREFUSED, Could not retrieve directory listing, or Connection timed out after passive mode failed. This guide covers every root cause behind DirectAdmin FTP not working, from passive port misconfiguration and firewall blocks to NAT/IP address mismatches and ProFTPd vs Pure-FTPd differences.
1. Understand Active vs Passive FTP Mode
Before troubleshooting, you need to understand which FTP mode is failing. Active and passive mode have completely different connection flows, and your firewall needs different rules for each.
- Active mode: The server connects back to the client's port. This almost always fails through NAT firewalls and is not recommended for modern use.
- Passive mode (PASV): The client connects to a random high port on the server that the server opens. This requires a defined port range to be open in your firewall.
Most FTP clients (FileZilla, WinSCP, Cyberduck) default to passive mode. If you see PASV in the connection log before the error, you have a passive mode problem.
Check which FTP daemon DirectAdmin is running
ps aux | grep -E "pureftpd|proftpd" | grep -v grep
DirectAdmin installations typically use either Pure-FTPd or ProFTPd. The fix differs slightly between them.
💡 None of these worked? Skip the guesswork.
Get Expert Help →2. Check the Passive Port Range Configuration
The most common cause of passive FTP failures on DirectAdmin is that the passive port range is not defined in the FTP daemon's configuration — or it is defined but not opened in the firewall.
For Pure-FTPd:
grep -i "PassivePorts\|PassivePortRange" /etc/pure-ftpd.conf /etc/pure-ftpd/conf/PassivePorts 2>/dev/null
You should see a range like 35000 35999. If this file or setting is missing, passive connections will use random ports that your firewall will block.
echo "35000 35999" > /etc/pure-ftpd/conf/PassivePorts
# or edit /etc/pure-ftpd.conf and add:
PassivePortRange 35000 35999
systemctl restart pure-ftpd
# or:
service pure-ftpd restart
For ProFTPd:
grep -i "PassivePorts" /etc/proftpd.conf /etc/proftpd/proftpd.conf 2>/dev/null
grep -q "PassivePorts" /etc/proftpd.conf || echo "PassivePorts 35000 35999" >> /etc/proftpd.conf
systemctl restart proftpd
Edit /etc/csf/csf.conf and find the TCP_IN setting. Add the passive port range:
grep "TCP_IN" /etc/csf/csf.conf | head -3
Add 35000:35999 to the TCP_IN list:
sed -i 's/^TCP_IN = "/TCP_IN = "35000:35999,/' /etc/csf/csf.conf
Or edit the file directly and append 35000:35999 to the comma-separated list.
csf -r
If using iptables directly:
iptables -I INPUT -p tcp --dport 35000:35999 -j ACCEPT
service iptables save
# or:
iptables-save > /etc/iptables/rules.v4
Verify the ports are now open:
iptables -L INPUT -n | grep "35000"
hostname -I # internal IP(s)
curl -s ifconfig.me # public/external IP
echo "YOUR_PUBLIC_IP" > /etc/pure-ftpd/conf/ForcePassiveIP
Replace YOUR_PUBLIC_IP with the actual public IP from the curl command above.
Add this to /etc/proftpd.conf:
MasqueradeAddress YOUR_PUBLIC_IP
PassivePorts 35000 35999
systemctl restart pure-ftpd
# or:
systemctl restart proftpd
systemctl status pure-ftpd
# or:
systemctl status proftpd
If stopped, start it:
systemctl start pure-ftpd && systemctl enable pure-ftpd
ss -tlnp | grep ":21"
grep "^TCP_IN" /etc/csf/csf.conf | grep -o "21[^0-9]"
# or:
iptables -L INPUT -n | grep " 21 "
ftp localhost 21
You should receive a 220 banner from the FTP daemon. Type quit to exit.
Log in to DirectAdmin > FTP Management and confirm the FTP account is listed with the correct home path.
In DirectAdmin > FTP Management, click the FTP account and set a new password. Update this in your FTP client.
grep "your-ftp-username" /etc/passwd
ls -la /home/username/domains/yourdomain.com/public_html/
The directory must exist and be readable by the FTP user. If it was deleted or has wrong ownership, FTP logins will succeed but directory listing will fail.
echo "1" > /etc/pure-ftpd/conf/TLS
echo "2" > /etc/pure-ftpd/conf/TLSCipherSuite
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem -subj "/CN=ftp.yourdomain.com"
chmod 600 /etc/ssl/private/pure-ftpd.pem
systemctl restart pure-ftpd
In FileZilla, change the Protocol to FTP and Encryption to Require explicit FTP over TLS.
For persistent FTP connectivity issues across multiple DirectAdmin server accounts, CloudHouse's DirectAdmin managed support team can audit your FTP daemon configuration, firewall rules, and passive port setup — and fix it in a single session.
