Here the data channel connection makes it through fine, but the two data channel connections are blocked. When a firewall is placed between the client and the server, the following may occur: In 'active mode' the data-channel connections are made in the opposite direction (server to client), which is even less firewall-friendly. In fact, a new connection is made for each listing and transfer, so there may well be many more than three connections in total.Д«y the way, this diagram shows what happens in ' passive mode'. Notice that there are three connections in this case: the control channel connection and then one for a directory listing and one for a file transfer. The first diagram show what happens when there's no firewall between the client and the server:

The following diagrams illustrate the problem. What a user of an FTP client usually sees is that the client successfully connects and authenticates but then hangs while it's trying to get a directory listing. Each of these additional socket connections must be made on a different port, so even though the main FTP connection (called the 'control channel') may have made it through the firewall, the additional connections (called 'data channels') may be blocked. A new socket connection is made for every directory listing and for every file transfer. The root cause of the problem is that a single session using these protocols requires more than one socket connection. Firewalls present challenges for users of FTP and (particularly) FTPS.

Ftp ports to open on firewall