How do I tell whether EAI_NONAME is DNS or firewall?

Run nslookup ftp.yourserver.com from the command line. If that resolves to an IP, DNS is fine and the issue is firewall-side (the client can't actually connect to the IP). If nslookup also fails, the resolver chain is broken — see the Linux EAI_NONAME guide instead.

Why specifically does the article say to switch to passive mode?

Active FTP needs the server to open a connection back to the client. Home routers, corporate NATs, and most firewalls block inbound connections by default — so active mode fails predictably. Passive mode flips the direction: the client opens both connections to the server, which 99 % of firewall setups allow.

ISP-level FTP block — is that real?

Yes, especially on residential connections that block outbound port 21 to prevent malware-distributing FTP servers. Test with telnet ftp.yourserver.com 21 or curl ftp://ftp.yourserver.com/ — if you get "connection refused" or "timeout," the ISP is dropping. SFTP (port 22) almost always works as a replacement.

After whitelisting in Windows Firewall the error still appears.

Third-party antivirus may have its own firewall layer that overrides Windows. Disable the antivirus's network protection temporarily to test; if FTP works without it, add filezilla.exe (or your FTP client) to the antivirus's whitelist instead of disabling protection.

Fix "EAI_NONAME FTP Error" — Firewall Blocking FTP Connections

7 min read

26.02.2026

The "EAI_NONAME - Neither nodename nor servname provided, or not known" FTP error often indicates DNS resolution issues, but if your firewall is blocking FTP traffic, you may experience connection timeouts or refused connections alongside this error. This guide focuses specifically on configuring firewalls on Windows, Linux (UFW/Firewalld/Iptables), and routers to allow FTP access.

Firewall Blocking FTP Connection Error — Firewalls blocking FTP — the EAI_NONAME variant that's really an outbound block.

For the FileZilla-specific variant of the same error, see Fix "EAI_NONAME" Error in FileZilla — Firewall & Network Guide; for the Linux/resolver-side variant, Fix "EAI_NONAME" Error — Complete DNS Resolution Guide.

Error Context: While EAI_NONAME suggests a DNS problem, it can appear when firewalls block the initial FTP connection or DNS queries. If you've already checked DNS settings and the error persists, firewall configuration is the likely culprit. This error commonly affects FileZilla, WinSCP, and other FTP clients.

Understanding the Error

The EAI_NONAME error combined with FTP connection failures typically means:

The FTP client successfully resolves the hostname to an IP address (DNS works)
But the firewall blocks the actual FTP connection attempt (TCP ports 21, 20, or 990)
Or the firewall blocks DNS queries before the connection even attempts

Firewalls can block FTP at multiple levels:

Local software firewall: Windows Defender, third-party antivirus
Operating system firewall: UFW, Firewalld, iptables on Linux
Network firewall: Router/access point security settings
Corporate/ISP firewall: Network-level blocking of FTP ports

Check If the Firewall Is Blocking FTP

Before modifying firewall settings, verify that FTP ports are actually being blocked.

Test FTP Port Connectivity

Using Netcat (Cross-Platform):

# Test standard FTP port (21)
nc -zv ftp.yourdomain.com 21

# Test FTPS port (990)
nc -zv ftp.yourdomain.com 990

# Test from a specific source port (if needed)
nc -zv -p 50000 ftp.yourdomain.com 21

Using Telnet:

# Windows/Linux/macOS (if telnet is installed)
telnet ftp.yourdomain.com 21

Using PowerShell (Windows):

Test-NetConnection -ComputerName ftp.yourdomain.com -Port 21

Interpretation of Results:

Result	Meaning	Action
Connection succeeded `Connected to ftp.yourdomain.com port 21`	FTP port is open and accessible	Firewall is not blocking; check other issues
Connection refused `Connection refused`	Port is closed or service not running	Check if FTP server is running, then firewall
Timeout `Operation timed out`	Firewall is actively blocking/dropping packets	Configure firewall to allow FTP traffic
No route to host	Network connectivity issues	Check network configuration and routing

Allow FTP in Windows Firewall

Method 1: Allow Specific FTP Application

Open Control Panel > System and Security > Windows Defender Firewall
Click "Allow an app or feature through Windows Defender Firewall"
Click "Change settings" (requires administrator privileges)
Find your FTP client (FileZilla, WinSCP, etc.) in the list
If not listed, click "Allow another app..." and browse to the executable:
- FileZilla: C:\Program Files\FileZilla FTP Client\filezilla.exe
- WinSCP: C:\Program Files (x86)\WinSCP\WinSCP.exe
Check both Private and Public network boxes
Click OK to save

Method 2: Open FTP Ports Manually (Advanced)

Open Windows Defender Firewall with Advanced Security
```
# Open via Run dialog (Win+R)
wf.msc
```
In the left pane, select Inbound Rules
Click New Rule... in the right Actions pane
Select Port > Next
Select TCP and enter 21 in "Specific local ports"
Select Allow the connection > Next
Check all three profiles (Domain, Private, Public) > Next
Name: "FTP Control Port 21" > Finish
Repeat for port 20 (FTP Data) and 990 (FTPS) if needed

Method 3: Windows Security App (Windows 10/11)

Open Windows Security (shield icon in system tray)
Go to Firewall & network protection
Click "Allow an app through firewall"
Click "Change settings" > Add your FTP client > Check network types > OK

Third-Party Antivirus: Applications like Norton, McAfee, Kaspersky, or Bitdefender have their own firewalls that override Windows Defender. Check these applications' settings and temporarily disable them for testing if FTP connections work.

Allow FTP in Linux Firewalls

UFW (Ubuntu/Debian)

# Allow standard FTP ports
sudo ufw allow 21/tcp    # FTP control connection
sudo ufw allow 20/tcp    # FTP data connection (active mode)

# For FTPS (FTP over SSL/TLS)
sudo ufw allow 990/tcp

# For passive FTP, allow a port range (e.g., 30000:50000)
sudo ufw allow 30000:50000/tcp

# Apply changes
sudo ufw reload

# Verify rules
sudo ufw status numbered

Firewalld (CentOS/RHEL/Fedora)

# Add FTP service (opens ports 21, 20, 990)
sudo firewall-cmd --add-service=ftp --permanent

# For passive FTP, add a custom port range
sudo firewall-cmd --add-port=30000-50000/tcp --permanent

# For explicit FTPS (if not included in ftp service)
sudo firewall-cmd --add-port=21/tcp --permanent
sudo firewall-cmd --add-port=990/tcp --permanent

# Apply changes
sudo firewall-cmd --reload

# Verify configuration
sudo firewall-cmd --list-all
sudo firewall-cmd --list-ports

Iptables (Manual Configuration)

# Allow FTP control connection
sudo iptables -A INPUT -p tcp --dport 21 -j ACCEPT

# Allow FTP data connection (active mode)
sudo iptables -A INPUT -p tcp --dport 20 -j ACCEPT

# Allow FTPS
sudo iptables -A INPUT -p tcp --dport 990 -j ACCEPT

# For passive FTP, allow a range
sudo iptables -A INPUT -p tcp --dport 30000:50000 -j ACCEPT

# Allow related/established connections
sudo iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# Save rules (distribution-dependent)
# For systems with iptables-persistent:
sudo netfilter-persistent save

# For CentOS/RHEL 7+:
sudo service iptables save

# For others:
sudo iptables-save > /etc/iptables/rules.v4

FTP Port Reference:

Port 21: FTP control - commands and responses (always needed)
Port 20: FTP data - file transfers in active mode (often blocked)
Port 990: FTPS (FTP over implicit SSL/TLS) - encrypted control
Ports 30000-50000: Common range for passive mode data connections

Check Router Settings & Port Forwarding

If you're connecting to an FTP server behind a home/office router, configure port forwarding.

Log into your router: Typically http://192.168.1.1, http://192.168.0.1, or check the router label
Find Port Forwarding/Virtual Server: Usually under Advanced Settings, Security, or NAT

Add forwarding rules:

Service Name	Protocol	External Port	Internal Port	Internal IP
FTP Control	TCP	21	21	[FTP server's local IP]
FTP Data (Active)	TCP	20	20	[FTP server's local IP]
FTPS	TCP	990	990	[FTP server's local IP]
FTP Passive Range	TCP	30000-50000	30000-50000	[FTP server's local IP]

Save settings and restart router if necessary

Important: If you're the FTP client (not server), you typically don't need port forwarding on your router. Port forwarding is only necessary if you're hosting an FTP server behind a NAT router. As a client, you need outbound rules, which most home routers allow by default.

Use Passive Mode in FileZilla

Passive mode (PASV) is often more firewall-friendly because all connections are initiated by the client.

Open FileZilla
Go to Edit > Settings (Windows) or FileZilla > Settings (Mac)
Navigate to Connection > FTP
Select Passive (recommended) under Transfer mode
Optional: Check "Fall back to active mode"
For specific networks, you may need to configure:
- Use the server's external IP address instead (if behind NAT)
- Limit local ports to a specific range for easier firewall rules
Click OK and try connecting

Active vs. Passive Mode:

Aspect	Active Mode	Passive Mode
Control Connection	Client > Server (port 21)	Client > Server (port 21)
Data Connection	Server > Client (port 20)	Client > Server (random port)
Firewall Friendly	No - requires inbound to client	Yes - all outbound from client
NAT Compatibility	Poor	Good

Most modern FTP clients default to passive mode for better firewall/NAT compatibility.

Summary of Firewall Fixes for "EAI_NONAME FTP Error"

Firewall System	Solution	Verification Command
Windows Defender	Allow app in firewall settings; open ports 21, 20, 990	`Test-NetConnection -ComputerName ftp.server.com -Port 21`
UFW (Ubuntu/Debian)	`sudo ufw allow 21/tcp` and port range for passive	`sudo ufw status numbered`
Firewalld (RHEL/CentOS)	`sudo firewall-cmd --add-service=ftp --permanent`	`sudo firewall-cmd --list-all`
Iptables	Add ACCEPT rules for FTP ports and save	`sudo iptables -L -n \| grep :21`
Router Firewall	Configure port forwarding for server; disable SPI firewall for testing	External port scanner (e.g., YouGetSignal.com)
Third-Party AV	Temporarily disable; add FileZilla to exceptions	Connect with security software disabled
FileZilla Settings	Switch to Passive mode; verify encryption settings	Edit > Settings > Connection > FTP

Final Troubleshooting Steps: If FTP still fails after firewall configuration:

Test with a different FTP client (WinSCP, Cyberduck) to rule out FileZilla-specific issues
Connect from a different network (mobile hotspot) to check ISP blocking
Verify the FTP server is actually running and accessible
Check if you need SFTP (SSH-based, port 22) instead of traditional FTP
Consult with your network administrator for corporate/enterprise environments