Passive vs active FTP

FTP uses two connections: a control connection for commands, and a data connection for each directory listing or file transfer. The mode - passive or active - decides who opens the data connection.

• Passive - the client opens the data connection to the server, just like it opened the control connection.
• Active - the client tells the server its own IP address and port, and the server connects back to the client for data.

Which mode should I use?

Use passive mode unless you have full control of your firewall and your FTP client software. In passive mode the server never makes any connection to you, so it works from behind NAT and ordinary firewalls - which is why virtually every modern FTP client defaults to it.

When is active mode fine?

Only when the machine running the client is genuinely reachable from the internet: its firewall admits inbound FTP data connections, and the client software knows its own public IP address. That is rare outside of purpose-configured servers - if you are unsure, that alone is the answer: use passive.

Related

• Passive mode is why FTP needs extra data ports open beyond port 21 - the ranges are listed in Static IP addresses and ports.
• Running the self-hosted server? The -publicip flag is your side of the same handshake - see Server parameters.