Why FTP cannot use passive mode to transfer data in Alibaba Finance Cloud

Symptoms

An FTP client in Alibaba Finance Cloud fails to connect to a configured FTP server, even when a VPN connection is active.

Cause

VPN connections in Alibaba Finance Cloud have port restrictions. By default, all inbound traffic is denied. You must create rules to explicitly allow traffic on specific ports. For better compatibility, FTP clients and servers use passive mode by default. In passive mode, data transfer ports are randomly assigned. The connection fails because security groups block these randomly assigned ports.

Solutions

• In the security group, you can allow traffic on all TCP ports (1-65535) from the source IP address. This ensures that data can be transferred on any port that FTP uses.
• You can use active mode on the FTP client. In active mode, FTP uses ports 21 and 20 by default. To transfer files, you must add rules to the security group of the ECS instance to allow traffic on these two ports.