FTP 425 and 426 Errors: Data Connection and Transfer Problems
FTP replies 425 and 426 usually point to the data channel rather than the login credentials. One means the data connection could not open; the other means a transfer ended before completion.
The difference between 425 and 426
The FTP control connection carries commands and replies, while a separate data connection carries directory listings and files. Login can therefore succeed even when a 425 error follows.
A 426 response means the data path opened but failed to complete because of a network interruption, timeout, storage problem or server-side termination.
| Code | Basic meaning | Typical stage |
|---|---|---|
| 425 | Cannot open the data connection | Before a listing or transfer starts |
| 426 | Connection closed; transfer aborted | After data transfer has begun |
What causes FTP 425?
The firewall or cloud security group may reject the data port announced by the server.
A server behind NAT may advertise a private or otherwise unreachable address.
The return connection from server to client can be blocked by NAT, mobile networking or the client firewall.
The server may have reached its simultaneous data-connection limit.
The TLS protection policy may not agree between control and data channels.
What causes FTP 426?
Wi-Fi, mobile data, VPN or an intermediate router may drop the connection during transfer.
A slow or stalled transfer can exceed a client, server or firewall timer.
An upload may stop after beginning when destination storage reaches its limit.
A scanner, policy or FTP service can close the data stream.
Background restrictions or a user action may abort the transfer and close the connection.
Step-by-step client checks
- 1Use passive mode
Passive FTP is usually the practical choice on mobile and NAT-based networks.
- 2Verify the security type
FTP, explicit FTPS or implicit FTPS and the selected port must match the server.
- 3Try a small file
If listing and a small transfer work but a large one fails, focus on timeout and network stability.
- 4Test another trusted network
A controlled comparison can isolate a router or provider-side filter.
- 5Find PASV/EPSV in the log
Review the address and port announced by the server and the exact failure stage.
Passive FTP configuration on the server
Define a limited passive port range in the FTP service. Permit that same range in the operating-system firewall, router and cloud security group. When the server is behind NAT, it must advertise an address reachable by external clients.
Opening the control port alone is not sufficient. Match a small configured range with the network rules instead of exposing an arbitrary range of high ports.
Broad public access used as a test can become a permanent security gap. Permit only the configured passive range and appropriate source addresses.
Narrow the problem with evidence
Record the command, PASV/EPSV response and timing immediately before 425 or 426.
Find the matching data-socket, TLS, limit or file-system event.
Verify control port and passive data range separately.
Change only the network, protocol type or file size in each comparison.
Put the guide into practice.
Review the related Varkuna product or open its detailed user guide.