Port Forwarding Use Case

FTP Server Port Forwarding

FTP is more complex than many home services because the control connection and the data connection are not the same thing. Passive mode and passive port ranges matter just as much as the main login port.

Expanded use-case review - May 7, 2026

Quick context

Users often open port 21 and stop there, then wonder why login works inconsistently or file transfer fails. FTP has a control channel and separate data behavior, which means the server mode and passive range design matter at least as much as the router rule itself.

30-second path

Use this order before you start changing settings.

Step 1Confirm the goalDecide whether this page is about login, open ports, Wi-Fi settings, or NAT diagnosis.Port Forwarding Not Working Step 2Verify with a toolBefore changing settings, check the outside-visible IP, port, DNS, or NAT signal you need.Port Checker Step 3Narrow the blockerIf the result is not expected, narrow it through firewall, double NAT, CGNAT, and wrong-router checks.Troubleshooting

See the flow visually

FTP passive mode path

FTP passive mode preview

RouterWiz port forwarding setup flow diagram

FTP often fails because the control port reaches the server but the data connection has nowhere valid to go through the firewall and NAT path.

The login port is not the whole story.
Passive mode requires a defined data range.
The server may also need to advertise the correct external address.

Check a public service

Related visual cues

Helpful visuals for this page

Selected RouterWiz visuals that match this topic.

What to know first

Typical control portTCP 21
Most common hidden requirementPassive mode data port range
Best modern alternativeConsider SFTP if you control both ends
Common mistakeForwarding only 21 and ignoring passive data traffic

Step-by-step

Confirm the FTP service is really running and note whether you are using active mode, passive mode, or a server default that must be reviewed.
Assign the FTP server a stable internal IP before you create any forwarding rule.
Forward the control port, usually TCP 21, to the FTP server host.
Define a passive data port range on the FTP server so the data path is predictable instead of random.
Forward the same passive data port range through the router to the same internal host.
If the FTP server sits behind NAT, configure the server with the correct external IPv4 address or external address advertisement setting if the product supports it.
Test both authentication and actual file transfer from an outside network. Successful login alone does not prove that the data channel is working.
If the control path works but directory listing or file transfer fails, review passive mode range, firewall rules, and external address configuration before touching unrelated router settings.

Checks and notes

FTP often appears half-broken when only the control port is forwarded.
Passive mode is usually the easier model to support through NAT than active mode in home environments.
Server-side firewall policy can break data ports even when the router rule is correct.

Warnings

FTP exposes more moving parts than a simple web or game server port.
If you do not specifically need classic FTP, SFTP is often easier to secure and easier to explain.

FAQ

Why can I log in but still fail to transfer files?

Because login uses the control connection, while directory listing and actual file transfer depend on the data connection. If the passive data range or the server’s external address is wrong, the session can authenticate and still fail during real use.

Do I need to forward more than one port for FTP?

Usually yes. TCP 21 handles the control connection, but passive FTP also needs a defined data port range. That range must be opened consistently on the server and on the router.

Recommended references

FTP forwarding is rarely just one port. Control, passive data ports, and external address handling all matter.

How to use these references

FTP is one of the easiest places to misread the path. RouterWiz should explain the forwarding chain first, then these references help confirm passive-mode requirements on the server itself.