FTP fails entering passive mode due to incorrect Passive Mode IP – cPanel

Symptoms

When attempting to connect to an FTP server, the client fails with an error similar to the following:

CONFIG_TEXT: 227 Entering Passive Mode
Error: Connection Timeout

This can occur when the Passive IP address is incorrectly set for the FTP server.

ProFTPd

In ProFTPd, this option is defined as the MasqueradeAddress in the /etc/proftpd.conf file.

To update this setting:

Access the server as root using SSH, or using the Terminal in WHM.
Determine the server's current public IP address with the following:

# curl myip.cpanel.net
Update the ProFTPd configuration file:

# nano /var/cpanel/conf/proftpd/local

Note: The above local configuration is modified so that changes are persistent when the configuration is rebuilt.
Add the correct MasqueradeAddress option to this file:
1. If the server is in a NAT, use the public IP:
  
  CONFIG_TEXT: MasqueradeAddress: 203.0.113.2
  
  Note: Replace 203.0.113.2 with the public IP of the server as reported in step 2.
2. If the server does not use a NAT, update this to the following:
  
  CONFIG_TEXT: MasqueradeAddress: ~
  
  Note: Using ~ turns off this mechanism so the bound IPs are used.
Rebuild and restart the ProFTPd service:

# /scripts/setupftpserver proftpd --force && /scripts/restartsrv_ftpd

Pure-FTPd

In Pure-FTPd, this option is defined as the ForcePassiveIP in the /etc/pure-ftpd.conf file.

To update this setting:

Access the server as root using SSH, or using the Terminal in WHM.
Determine the server's current public IP address with the following:

# curl myip.cpanel.net
Update the Pure-FTPd configuration file:

# nano /var/cpanel/conf/pureftpd/local

Note: The above local configuration is modified so that changes are persistent when the configuration is rebuilt.
Add the correct ForcePassiveIP option to this file:
1. If the server is in a NAT, use the public IP:
  
  CONFIG_TEXT: ForcePassiveIP: 203.0.113.2
  
  Note: Replace 203.0.113.2 with the public IP of the server as reported in step 2.
2. If the server does not use a NAT, update this to the following:
  
  CONFIG_TEXT: ForcePassiveIP: ~
  
  Note: Using ~ turns off this mechanism so the bound IPs are used.
Rebuild and restart the Pure-FTPd service:

# /scripts/setupftpserver pureftpd --force && /scripts/restartsrv_ftpd