FTP Client "Connection Timeout"

Question

FTP Client "Connection Timeout"

pierre shiraziefard 165

hello,

I have a public facing FTP resource I am trying to setup.

I have configured this vm for FTP access, configured the vm firewall rules correctly, setup inbound rules correctly on azure.

using passive ftp

Yet using filezilla as test, logs in successfully but fails on retrieving directory with "connection timeout" I confirmed its connecting using passive mode (pic attached)

Need help in getting this service working for us.

MotoX80 37,866 Reputation points

2026-02-19T17:34:49.4066667+00:00

I would recommend using SFTP and not FTP. That way you only need to open port 22 and you get the added benefit that your data in encrypted while it flows over the internet.

https://www.bing.com/search?q=implement+sftp+windows
pierre shiraziefard 165 Reputation points

2026-02-21T14:04:32.73+00:00

Filezilla log file attached, all parameters like you mentioned are setup correctly.

2026-02-20 14:29:53 11484 2 Status: Connecting to x

2026-02-20 14:29:53 11484 2 Status: Connection established, waiting for welcome message...

2026-02-20 14:29:53 11484 2 Response: 220 Microsoft FTP Service

2026-02-20 14:29:53 11484 2 Command: AUTH TLS

2026-02-20 14:29:53 11484 2 Response: 534 Local policy on server does not allow TLS secure connections.

2026-02-20 14:29:53 11484 2 Command: AUTH SSL

2026-02-20 14:29:53 11484 2 Response: 534 Local policy on server does not allow TLS secure connections.

2026-02-20 14:29:53 11484 2 Status: Insecure server, it does not support FTP over TLS.

2026-02-20 14:29:53 11484 2 Command: USER (my user name I removed it from this log file)

2026-02-20 14:29:53 11484 2 Response: 331 Password required

2026-02-20 14:29:53 11484 2 Command:

2026-02-20 14:29:53 11484 2 Response: 230 User logged in.

2026-02-20 14:29:53 11484 2 Command: OPTS UTF8 ON

2026-02-20 14:29:53 11484 2 Response: 200 OPTS UTF8 command successful - UTF8 encoding now ON.

2026-02-20 14:29:53 11484 2 Status: Logged in

2026-02-20 14:29:53 11484 2 Status: Retrieving directory listing...

2026-02-20 14:29:53 11484 2 Command: PWD

2026-02-20 14:29:53 11484 2 Response: 257 "/" is current directory.

2026-02-20 14:29:53 11484 2 Command: TYPE I

2026-02-20 14:29:53 11484 2 Response: 200 Type set to I.

2026-02-20 14:29:53 11484 2 Command: PASV

2026-02-20 14:29:53 11484 2 Response: 227 Entering Passive Mode

2026-02-20 14:29:53 11484 2 Command: LIST

2026-02-20 14:29:53 11484 2 Response: 150 Opening BINARY mode data connection.

2026-02-20 14:30:13 11484 2 Error: Connection timed out after 20 seconds of inactivity

2026-02-20 14:30:13 11484 2 Error: Failed to retrieve directory listing

2026-02-20 14:30:13 11484 2 Status: Disconnected from server
MotoX80 37,866 Reputation points

2026-02-21T15:48:45.9666667+00:00

Did you configure the Data Channel Port Range and add the appropriate firewall rule for those ports?
pierre shiraziefard 165 Reputation points

2026-02-23T13:05:05.46+00:00

Yes I did
MotoX80 37,866 Reputation points

2026-02-23T13:27:03.58+00:00

The Response 227 entry indicates that it is trying to connect on port 3001. Since that times out, that indicates that the culprit is either the Azure firewall or Windows VM firewall. Did you have to set up any port forwarding rules?
pierre shiraziefard 165 Reputation points

2026-02-23T15:16:07.99+00:00

yes we tried that as well, on the vm firewall its open 21, 49152-65535. on azure vm firewall its port 21
pierre shiraziefard 165 Reputation points

2026-02-23T15:28:54.3266667+00:00

tried it again and logs is below

2026-02-23 10:24:03 1536 1 Status: Connecting to (REMOVED THE IP ADDRESS - PIERRE).

2026-02-23 10:24:03 1536 1 Status: Connection established, waiting for welcome message...

2026-02-23 10:24:03 1536 1 Response: 220 Microsoft FTP Service

2026-02-23 10:24:03 1536 1 Command: AUTH TLS

2026-02-23 10:24:03 1536 1 Response: 534 Local policy on server does not allow TLS secure connections.

2026-02-23 10:24:03 1536 1 Command: AUTH SSL

2026-02-23 10:24:03 1536 1 Response: 534 Local policy on server does not allow TLS secure connections.

2026-02-23 10:24:03 1536 1 Status: Insecure server, it does not support FTP over TLS.

2026-02-23 10:24:03 1536 1 Command: USER "my user name - REMOVED HERE IN THIS LOG"

2026-02-23 10:24:03 1536 1 Response: 331 Password required

2026-02-23 10:24:03 1536 1 Command: PASS ***************

2026-02-23 10:24:03 1536 1 Response: 230 User logged in.

2026-02-23 10:24:03 1536 1 Command: SYST

2026-02-23 10:24:03 1536 1 Response: 215 Windows_NT

2026-02-23 10:24:03 1536 1 Command: FEAT

2026-02-23 10:24:03 1536 1 Response: 211-Extended features supported:

2026-02-23 10:24:03 1536 1 Response: LANG EN*

2026-02-23 10:24:03 1536 1 Response: UTF8

2026-02-23 10:24:03 1536 1 Response: AUTH TLS;TLS-C;SSL;TLS-P;

2026-02-23 10:24:03 1536 1 Response: PBSZ

2026-02-23 10:24:03 1536 1 Response: PROT C;P;

2026-02-23 10:24:03 1536 1 Response: CCC

2026-02-23 10:24:03 1536 1 Response: HOST

2026-02-23 10:24:03 1536 1 Response: SIZE

2026-02-23 10:24:03 1536 1 Response: MDTM

2026-02-23 10:24:03 1536 1 Response: REST STREAM

2026-02-23 10:24:03 1536 1 Response: 211 END

2026-02-23 10:24:03 1536 1 Command: OPTS UTF8 ON

2026-02-23 10:24:03 1536 1 Response: 200 OPTS UTF8 command successful - UTF8 encoding now ON.

2026-02-23 10:24:03 1536 1 Status: Logged in

2026-02-23 10:24:03 1536 1 Status: Retrieving directory listing...

2026-02-23 10:24:03 1536 1 Command: PWD

2026-02-23 10:24:03 1536 1 Response: 257 "/" is current directory.

2026-02-23 10:24:03 1536 1 Command: TYPE I

2026-02-23 10:24:03 1536 1 Response: 200 Type set to I.

2026-02-23 10:24:03 1536 1 Command: PASV

2026-02-23 10:24:03 1536 1 Response: 227 Entering Passive Mode (20,110,161,44,192,4).

2026-02-23 10:24:03 1536 1 Command: LIST

2026-02-23 10:24:04 1536 1 Response: 150 Opening BINARY mode data connection.

2026-02-23 10:24:24 1536 1 Error: Connection timed out after 20 seconds of inactivity

2026-02-23 10:24:24 1536 1 Error: Failed to retrieve directory listing

2026-02-23 10:24:24 1536 1 Status: Disconnected from server

2026-02-23 10:24:24 1536 1 Status: Connecting to (REMOVED - PIERRE)...

2026-02-23 10:24:24 1536 1 Status: Connection established, waiting for welcome message...

2026-02-23 10:24:24 1536 1 Response: 220 Microsoft FTP Service

2026-02-23 10:24:24 1536 1 Command: AUTH TLS

2026-02-23 10:24:24 1536 1 Response: 534 Local policy on server does not allow TLS secure connections.
MotoX80 37,866 Reputation points

2026-02-23T15:43:44.3166667+00:00

https://cordero.me/troubleshooting-ftp-passive-mode-issues-prodftp-vs-devftp/

2026-02-20 14:29:53 11484 2 Response: 227 Entering Passive Mode (20,110,161,44,11,185).

(11*256) + 185 = 3001

You need to open the data channel port range 3001-30xx on both the Azure firewall and the VM firewall.

I had to write a rule to allow that range.

That should also show up in your FTP log.

When I changed the data port number, I found that I had to stop and start the FTP service to implement that on my Win10 test VM.

Are you sure that you don't want to install the OpenSSH feature and use SFTP? You only have to deal with port 22 then.
Vallepu Venkateswarlu 10,595 Reputation points Microsoft External Staff Moderator

2026-02-23T17:53:22.5966667+00:00

Hi @ pierre shiraziefard,

Thank you for sharing the log details.

Based on the error, the issue is not related to authentication or the Azure NSG on port 21. The problem is with the passive data port.

The calculation (11 × 256) + 185 = 3001 indicates that the client is attempting to connect to: 20.110.161.44:3001

This connection is being blocked.

To resolve the issue, passive data ports must be allowed. The recommended approach is to configure a fixed passive port range in IIS and then open only that specific port range in both Azure (NSG) and the Windows Firewall.

For the passive ftp endpoint, you have to choose "custom" service to allow arbitrary port range.

Follow the Server 2012 VM on Azure - Passive FTP Won't Work & How to set up FTP on Azure VM for more troubleshoot.

Could you please provide the requested information in a private message so we can troubleshoot further?

Please "upvote" if the information helped you. This will help us and others in the community as well.
Vallepu Venkateswarlu 10,595 Reputation points Microsoft External Staff Moderator

2026-02-24T16:52:33.65+00:00

Hi @ pierre shiraziefard,

I hope this information helps resolve your issue. Please feel free to ask if the provided solution does not help or if you have any additional questions.
pierre shiraziefard 165 Reputation points

2026-02-27T16:02:58.2233333+00:00

ok, on azure vm network setting created inbound and outbound port rules with

port-range 21,60000-60010 and ftp service.

Created the same on VM firewall both inbound and outbound rules

and also re-configured the iis ftp firewall with 21,60000-60010.

Still no luck, now it does not even successfully log-in. Any chance we can schedule a screen share time as we have paid support but cannot locate that option on azure to create a ticket.

Thanks.
MotoX80 37,866 Reputation points

2026-02-27T16:29:08.6833333+00:00

I don't work for Microsoft. (Retired server admin.)

I can't speak for Vallepu but I've never seen anyone offer screen sharing support in this free/public forum.

Screen images work best here.
Vallepu Venkateswarlu 10,595 Reputation points Microsoft External Staff Moderator

2026-02-27T16:35:29.83+00:00

Hi @ pierre shiraziefard,

Thank you for sharing the details, and apologies for the inconvenience caused.

Kindly share the requested information via private message so we can proceed with further troubleshooting.

Answer accepted by question author

0 additional answers

Your answer

MotoX80 37,866 Reputation points

2026-02-19T17:34:49.4066667+00:00

I would recommend using SFTP and not FTP. That way you only need to open port 22 and you get the added benefit that your data in encrypted while it flows over the internet.

https://www.bing.com/search?q=implement+sftp+windows
pierre shiraziefard 165 Reputation points

2026-02-21T14:04:32.73+00:00

Filezilla log file attached, all parameters like you mentioned are setup correctly.

2026-02-20 14:29:53 11484 2 Status: Connecting to x

2026-02-20 14:29:53 11484 2 Status: Connection established, waiting for welcome message...

2026-02-20 14:29:53 11484 2 Response: 220 Microsoft FTP Service

2026-02-20 14:29:53 11484 2 Command: AUTH TLS

2026-02-20 14:29:53 11484 2 Response: 534 Local policy on server does not allow TLS secure connections.

2026-02-20 14:29:53 11484 2 Command: AUTH SSL

2026-02-20 14:29:53 11484 2 Response: 534 Local policy on server does not allow TLS secure connections.

2026-02-20 14:29:53 11484 2 Status: Insecure server, it does not support FTP over TLS.

2026-02-20 14:29:53 11484 2 Command: USER (my user name I removed it from this log file)

2026-02-20 14:29:53 11484 2 Response: 331 Password required

2026-02-20 14:29:53 11484 2 Command:

2026-02-20 14:29:53 11484 2 Response: 230 User logged in.

2026-02-20 14:29:53 11484 2 Command: OPTS UTF8 ON

2026-02-20 14:29:53 11484 2 Response: 200 OPTS UTF8 command successful - UTF8 encoding now ON.

2026-02-20 14:29:53 11484 2 Status: Logged in

2026-02-20 14:29:53 11484 2 Status: Retrieving directory listing...

2026-02-20 14:29:53 11484 2 Command: PWD

2026-02-20 14:29:53 11484 2 Response: 257 "/" is current directory.

2026-02-20 14:29:53 11484 2 Command: TYPE I

2026-02-20 14:29:53 11484 2 Response: 200 Type set to I.

2026-02-20 14:29:53 11484 2 Command: PASV

2026-02-20 14:29:53 11484 2 Response: 227 Entering Passive Mode

2026-02-20 14:29:53 11484 2 Command: LIST

2026-02-20 14:29:53 11484 2 Response: 150 Opening BINARY mode data connection.

2026-02-20 14:30:13 11484 2 Error: Connection timed out after 20 seconds of inactivity

2026-02-20 14:30:13 11484 2 Error: Failed to retrieve directory listing

2026-02-20 14:30:13 11484 2 Status: Disconnected from server
MotoX80 37,866 Reputation points

2026-02-21T15:48:45.9666667+00:00

Did you configure the Data Channel Port Range and add the appropriate firewall rule for those ports?
pierre shiraziefard 165 Reputation points

2026-02-23T13:05:05.46+00:00

Yes I did
MotoX80 37,866 Reputation points

2026-02-23T13:27:03.58+00:00

The Response 227 entry indicates that it is trying to connect on port 3001. Since that times out, that indicates that the culprit is either the Azure firewall or Windows VM firewall. Did you have to set up any port forwarding rules?
pierre shiraziefard 165 Reputation points

2026-02-23T15:16:07.99+00:00

yes we tried that as well, on the vm firewall its open 21, 49152-65535. on azure vm firewall its port 21
MotoX80 37,866 Reputation points

2026-02-23T15:43:44.3166667+00:00

https://cordero.me/troubleshooting-ftp-passive-mode-issues-prodftp-vs-devftp/

2026-02-20 14:29:53 11484 2 Response: 227 Entering Passive Mode (20,110,161,44,11,185).

(11*256) + 185 = 3001

You need to open the data channel port range 3001-30xx on both the Azure firewall and the VM firewall.

I had to write a rule to allow that range.

That should also show up in your FTP log.

When I changed the data port number, I found that I had to stop and start the FTP service to implement that on my Win10 test VM.

Are you sure that you don't want to install the OpenSSH feature and use SFTP? You only have to deal with port 22 then.
Vallepu Venkateswarlu 10,595 Reputation points Microsoft External Staff Moderator

2026-02-23T17:53:22.5966667+00:00

Hi @ pierre shiraziefard,

Thank you for sharing the log details.

Based on the error, the issue is not related to authentication or the Azure NSG on port 21. The problem is with the passive data port.

The calculation (11 × 256) + 185 = 3001 indicates that the client is attempting to connect to: 20.110.161.44:3001

This connection is being blocked.

To resolve the issue, passive data ports must be allowed. The recommended approach is to configure a fixed passive port range in IIS and then open only that specific port range in both Azure (NSG) and the Windows Firewall.

For the passive ftp endpoint, you have to choose "custom" service to allow arbitrary port range.

Follow the Server 2012 VM on Azure - Passive FTP Won't Work & How to set up FTP on Azure VM for more troubleshoot.

Could you please provide the requested information in a private message so we can troubleshoot further?

Please "upvote" if the information helped you. This will help us and others in the community as well.
Vallepu Venkateswarlu 10,595 Reputation points Microsoft External Staff Moderator

2026-02-24T16:52:33.65+00:00

Hi @ pierre shiraziefard,

I hope this information helps resolve your issue. Please feel free to ask if the provided solution does not help or if you have any additional questions.
pierre shiraziefard 165 Reputation points

2026-02-27T16:02:58.2233333+00:00

ok, on azure vm network setting created inbound and outbound port rules with

port-range 21,60000-60010 and ftp service.

Created the same on VM firewall both inbound and outbound rules

and also re-configured the iis ftp firewall with 21,60000-60010.

Still no luck, now it does not even successfully log-in. Any chance we can schedule a screen share time as we have paid support but cannot locate that option on azure to create a ticket.

Thanks.
MotoX80 37,866 Reputation points

2026-02-27T16:29:08.6833333+00:00

I don't work for Microsoft. (Retired server admin.)

I can't speak for Vallepu but I've never seen anyone offer screen sharing support in this free/public forum.

Screen images work best here.
Vallepu Venkateswarlu 10,595 Reputation points Microsoft External Staff Moderator

2026-02-27T16:35:29.83+00:00

Hi @ pierre shiraziefard,

Thank you for sharing the details, and apologies for the inconvenience caused.

Kindly share the requested information via private message so we can proceed with further troubleshooting.

Answer 1

Hi @ pierre shiraziefard,

Welcome to Microsoft Q&A Platform.

This issue is consistent with passive FTP data channel connectivity restrictions and is not related to authentication or an FTP service failure. Once the passive port range is properly defined and allowed through all firewall layers (FTP service configuration, OS firewall, and Azure NSG), directory listing should function normally.

Adding the following details based on logs:

The issue is not related to authentication or the Azure NSG on port 21. The problem lies with the passive data port.

The calculation (11 × 256) + 185 = 3001 indicates that the client is attempting to connect to: 20.X.X.44:3001

This connection is currently being blocked.

To resolve the issue passive data ports must be allowed.

Configure a fixed passive port range 49152-65535 in IIS.
Open only that defined port range in IIS
Allow the Port 21 and 49152-65535 in Azure Network Security Group.
Windows Firewall

Once the passive port range is consistently configured and permitted across all layers, FTP directory listing should work as expected.

Follow the Server 2012 VM on Azure - Passive FTP Won't Work & How to set up FTP on Azure VM for more troubleshoot.

Note: If the information above did not help to resolve the issue, kindly share the requested details in a private message for further troubleshoot.

Pleaseand “up-vote” wherever the information provided helps you, this can be beneficial to other community members.