Solve FTP Passive Mode Issue In WHM/Cpanel With CSF

Installing a Firewall (e.g., Config Security Firewall/CSF) is one step to hardening the security of your web server. But this comes with an issue: CSF blocks PureFTPd/ProFTPd server, so your FTP client cannot connect to the FTP server with passive mode. This is because CSF blocks the passive connection ports. To enable it you need to set the IP range for passive connections and make sure you are not blocking it from CSF.

To do that, you need to edit your FTP server configuration.

For PureFTPd:
Open /etc/pure-ftpd.conf, and enable this line:

PassivePortRange    30000 35000

For ProFTPd:
Open /etc/proftpd.conf, and enable this line:

PassivePorts    30000 35000

Now you need to unblock that port range from CSF. Open CSF Firewall configuration from your WHM, and add those ports in TCP_IN, so it would look like this:
TCP_IN: 20,21,22,25,53,80,110,143,443,30000:35000

Now restart both your CSF and FTP server. And once it’s done, you will be able to connect to your FTP server with passive mode.