Cerberus FTP Server Passive Port Range Firewall and Router Setup
Login works but the folder never lists - that is passive mode. Set one range in Cerberus, the firewall and the router, identically.
Technical AnshuWindowsPassive range, firewall and router in agreement
Watch - the Cerberus install in the video, then fix passive mode with this page
This is the most common Cerberus support problem in the world - login succeeds, file listing fails. It is almost never a password problem. It is the passive data range blocked in one of three places. This page lines up all three - Cerberus, Windows Firewall and the router - so they agree, and explains when SFTP lets you skip the whole issue.
Passive FTP - Why Login Works but Files Fail, Example Log
Client: Connected to 192.168.1.100 port 21
Server: 230 Login successful
Client: PASV
Server: 227 Entering Passive Mode (192,168,1,100,43,25)
Client: LIST
Result: Connection timed out - no data connection
Control port 21Working
Passive data portBlocked - listing fails
Example failure pattern. Login succeeds on port 21, then the listing stalls because the passive data port is blocked. Values are illustrative.
1
Why FTP Needs a Range, Not One Port
FTP uses two kinds of connection. The control connection on port 21, 990 or 22 carries logins and commands. The data connection carries listings and files, and in passive mode the server picks a port from its passive range and tells the client to connect there. If that range is blocked anywhere - Cerberus setting, Windows Firewall or router - the exact symptom is a successful login followed by an empty folder or a timeout. Knowing that pattern saves hours.
2
Set the Range in Cerberus First
In Server Manager, open the Protocols settings and find the passive port range. The Cerberus default is 11000-13000.
You may keep the default or set your own range, but keep it at least a few hundred ports wide. Official Cerberus guidance recommends a large range because each listing or transfer uses a port and a used port cannot be reused for several minutes.
Write the range down exactly. Every later step copies this range character for character - a range of 11000 to 13000 in Cerberus and 11000 to 12000 in the router is a bug, not a close enough match.
If the server sits behind NAT and Cerberus offers a passive IP setting, set the public IP address clients should connect back to. A private address like 192.168.1.100 in the PASV reply is unreachable from the internet.
3
Open the Same Range in Windows Firewall
Allow the control ports you actually use inbound - for example 21 for FTP or explicit FTPS, 990 for implicit FTPS, 22 for SFTP, 443 for HTTPS.
Create an inbound rule for the full passive TCP range, for example 11000-13000, pointing at the Cerberus service.
An example admin command for the passive range is netsh advfirewall firewall add rule name="Cerberus Passive" dir=in action=allow protocol=TCP localport=11000-13000 - adjust the name and range to match your Cerberus setting exactly.
Scope LAN only rules to the local subnet. Only widen the scope if this server is deliberately serving the internet.
4
Forward the Same Ports on the Router
Router forwarding is only needed for outside access. Skip this step entirely for a LAN only server - fewer open ports is a feature.
Give the server a fixed LAN IP first, by static address or DHCP reservation, so forwards always land on the right PC.
Forward each control port to the server IP - 21, 22, 990, 443, only the ones you enabled.
Forward the entire passive range to the same server IP. Forwarding port 21 alone is the classic half finished job that produces the login works, listing fails symptom.
Save, then test from a truly outside network - a phone on mobile data with WiFi off. Testing from inside the LAN can hide a broken forward completely.
5
The SFTP Shortcut Worth Knowing
If your users can use SFTP, much of this page becomes unnecessary for them. SFTP on port 22 carries commands and data on the single connection - there is no passive range, no second connection and no PASV reply problem. Many offices keep FTPS for compatibility and SFTP as the simple reliable route. The honest trade is client support - check what your users and devices actually speak before retiring FTP data ports.
Golden rule for passive FTP - one range, three places, identical everywhere. Cerberus Protocols settings, Windows Firewall and router forwarding must match exactly, or listings will fail while logins succeed.
Watch the Complete Video Guide
The video gets Cerberus online fast - this page fixes the passive port chain so outside users can actually list and transfer files.
What is the default passive port range in Cerberus FTP Server
The default suggested range is 11000 to 13000, shown in the Protocols settings in Server Manager. It is configurable, but keep at least several hundred ports because each listing or transfer consumes a port for a few minutes.
Why can I log in but not see any files in Cerberus
The control port is open but the passive data ports are blocked. Match the passive range exactly in Cerberus, in Windows Firewall and in router forwarding, and if the server is behind NAT make sure the PASV reply carries the public IP address.
Does SFTP need passive ports in Cerberus
No. SFTP uses the single SSH connection on port 22 for both commands and data, so there is no passive range to open or forward. That simplicity is a major reason admins prefer SFTP for internet facing transfers.
This guide is based on the Technical Anshu video - Install Cerberus FTP Server in 5 Minutes - Stuck on a step, ask in the video comments and you will get an answer there