Passive or Active: Picking FileZilla's Data-Channel Mode for a NAT-Blocked Production Server

FTP splits every session into a control channel (default port 21) and a separate data channel for listings and transfers, and the data channel is the common failure point when a FileZilla setup moves from a LAN to production. Passive mode, FileZilla's default, has the client connect out to a server-supplied address and port; active mode has the server connect back to the client. Each shifts the inbound-connection burden to a different side.

The trade-off sharpens under production constraints: a server behind NAT may advertise a private address in passive mode, a client behind a corporate firewall may reject inbound connections in active mode, and with FTPS an encrypted control channel stops a firewall from opening data ports dynamically. FileZilla 3.x exposes these settings in its connection options and Network Configuration Wizard; exact labels vary by release.

For a deployment where only one side can realistically publish a fixed, firewall-allowed port range:

• If the server operator can publish an external IP plus a fixed passive port range, is passive mode the safer default even under FTPS?
• If only the client side can open and forward a fixed port range, does active mode become the only workable option?
• Where neither side can guarantee inbound data ports, is plain FTP or FTPS the wrong protocol for that environment?