I'm trying to access my remote FTP server from a PC that is connected to our (Virgin) DSL modem via a switch (Netgear GS108PE). The switch is connected to a Router (Asus RT-AC68U) and that is connected to the modem. All are hard-wired with Cat5/6 ethernet.

I'm using FileZilla to access the FTP server, which connects to allow the handshake and accepts the login and password, but fails when listing directories (MLSD).

Here's the thing: I can access the directory list no problem from another PC linked to the router directly, but not the PC linked via the netgear switch. All are on the same network and all use DHCP from the router. I have turned all firewalls off and tried forwarding all FTP traffic to both the PC and/or the switch (really trying anything I could think of, really).

I've tried active and passive modes, port forwarding, disabling firewalls or anything else I can find, but feel like I may be missing something about the nature of the switch/router setup.

Any ideas on what I could try? I've spent all day on this and have obviously been googling the issue for most of that time. I have been working with home networks for 20+ years, but this one has me baffled.

Here's the message I get:

Status: Connection established, waiting for welcome message...
Status: Initializing TLS...
Status: Verifying certificate...
Status: TLS connection established.
Status: Server does not support non-ASCII characters.
Status: Connected
Status: Retrieving directory listing...
Command:    PWD
Response:   257 "/" is your current location
Command:    TYPE I
Response:   200 TYPE is now 8-bit binary
Command:    PASV
Response:   227 Entering Passive Mode (xxx,xxx,xxx,xxx,xxx,xxx)
Command:    MLSD
Error:  Connection timed out
Error:  Failed to retrieve directory listing

*I've changed the IPs (which are the correct external IP address of the FTP serve in question) to XXX in the above.

I'd appreciate any insight if you have some.


  • Did the other computer also use TLS? – Daniel B Jan 27 '15 at 21:49
  • Oh my god. I was just responding 'yes, the other PC is where I got the settings from and that's using it' but I like to double check things and BOOM! It's not using TLS. I know how that happened, but it's convoluted and you know how the story ends ;-) Thank you so much. I knew StackOverflow wouldn't let me down. Would you like to answer, so I can give you credit? – Astravagrant Jan 27 '15 at 22:02
  • This is not StackOverflow! It's SuperUser :) – Kristian Jan 27 '15 at 22:35
  • Sorry, I meant StackExchange! :) – Astravagrant Jan 28 '15 at 12:20

So I guess by turning off TLS you solved the problem.

Now, as for the reason TLS has an impact: On modern connection-tracking firewalls (necessary for Port Address Translation, for example), there are so-called tracking helpers that analyze protocols with Deep Packet Inspection.

FTP, with its separate control and data connections, is problematic for firewalls: Just allowing outbound connections on port 21 isn’t enough. That’s where the helper takes over: It analyzes the control connection and allows connections as per PASV (or EPSV) reply. With an encrypted control connection, analyzing it is impossible and connections won’t get through.

All this stuff is usually only relevant on “enterprise” firewalls, because SOHO routers allow all outgoing connections by default.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.