How to Install and Configure FileZilla Server on Windows and Linux

Applies to: FileZilla Server 1.12 on Windows (64-bit) and on Debian or Ubuntu Linux (x86-64)

FileZilla Server is a free FTP server for your own Windows or Linux server. It is a separate program from the FileZilla client: the client connects to servers, while FileZilla Server lets other people connect to yours. Version 1.x is a complete rewrite of the old 0.9 series, so menus in older guides (such as Edit › Settings or Shared folders) no longer exist.

What it supports: FTP and FTP over TLS (FTPS). It does not support SFTP; that needs the paid FileZilla Pro Enterprise Server. On Linux you usually don't need an extra program for SFTP, because the SSH server already provides it (see how to create an SFTP-only user with a chroot).

Using cPanel hosting? You don't need FileZilla Server. Your hosting account already has an FTP server; just create an FTP account in cPanel and connect with the FileZilla client.

How FileZilla Server is organised

• The server runs in the background as a Windows service or a Linux systemd service and accepts FTP connections on port 21.
• The Administration interface is the program you configure it with. It connects to the server on port 14148, which by default only listens on the server itself (127.0.0.1).
• Out of the box, the FTP listener is set to Require explicit FTP over TLS, so plain unencrypted FTP logins are refused. FileZilla Server creates a self-signed certificate for this during installation.

Install on Windows

1. Download FileZilla Server for Windows (64-bit) from the official FileZilla website: filezilla-project.org. The file is named FileZilla_Server_1.12.x_win64-setup.exe.
2. Run it as an administrator and accept the licence (GNU AGPL).
3. Components: keep All (the server and the Administration interface).
4. Service: keep the default, installed as a Windows service that starts automatically, running under the local SYSTEM account.
5. Administration port: keep 14148.
6. Set the administration password. It must be at least 12 characters with an upper-case letter, a lower-case letter, a number and a special character. Don't leave it empty.
7. Finish the setup. The server starts, and the Administration interface opens.

Install on Linux (Debian or Ubuntu)

The official Linux download is a .deb package for 64-bit x86 servers (built for Debian 11). We installed version 1.12.6 on Ubuntu 24.04 with the steps below. There is no official package for AlmaLinux or Rocky Linux; on those systems use vsftpd instead (see how to set up vsftpd with TLS).

1. Download the Linux package from the FileZilla Server download page and copy it to the server, for example with scp.
2. Install it with apt, which also installs the libraries it needs:

   sudo apt update
   sudo apt install ./FileZilla_Server_1.12.6_x86_64-linux-gnu.deb

3. Answer the setup questions:
   • Administrator password: choose a strong one (12+ characters, as above).
   • Allow administration connections on all network adapters? Answer No. You will reach the admin port securely through SSH instead (step 5).
   • System account for accessing files and directories: keep ftp. FTP users read and write files as this Linux account.
4. The service is enabled and started for you. Check it with:

   sudo systemctl status filezilla-server
   sudo journalctl -u filezilla-server -n 20

   The log should show Listening on 0.0.0.0:21 [Require explicit FTP over TLS] and the administration server on 127.0.0.1:14148. The configuration is stored in /opt/filezilla-server/etc.
5. To administer it from your own computer, install FileZilla Server there with only the Administration interface component (use the same version as the server), and open an SSH tunnel to the admin port:

   ssh -L 14148:127.0.0.1:14148 root@SERVER-IP

   Keep that SSH session open. If your computer runs its own FileZilla Server, use another local port, for example -L 14149:127.0.0.1:14148.
6. Create the folders for your FTP users and give them to the ftp account, otherwise uploads fail with a permission error:

   sudo mkdir -p /srv/ftp/webuser
   sudo chown ftp:ftp /srv/ftp/webuser

Connect the Administration interface

1. Open the Administration interface and enter host 127.0.0.1, port 14148 (or the local tunnel port) and the administration password.
2. On the first connection it shows the fingerprint of the server's admin certificate. On Linux you can compare it with the SHA256 certificate fingerprint lines in journalctl -u filezilla-server. Trust it to continue.
3. Open the settings with Server › Configure.

Create an FTP user

1. Go to Rights management › Users and click Add. Type the user name.
2. Under Credentials, require a password to log in and enter a strong password.
3. Under Mount points, click Add:
   • Virtual path: / (the folder the user sees after logging in).
   • Native path: the real folder on the server, for example C:\FTP\webuser on Windows or /srv/ftp/webuser on Linux.
   • Access: Read + Write to upload and change files, or Read only for downloads only. Leave Writable directory structure ticked if the user may create and rename folders.
   • Tick Create native directory if it doesn't exist if the folder isn't there yet.
4. Make sure User is enabled is ticked, then click Apply.

Each user can map / to a different folder, so users never see each other's files.

Set up passive mode

Most FTP clients use passive mode, where the server opens an extra port for each file transfer and directory listing. Choose a fixed range so you can open it in the firewall.

1. Go to Protocols settings › FTP and FTP over TLS (FTPS) and open the Passive mode tab.
2. Tick Use custom port range. FileZilla suggests 49152 to 65534; a smaller range such as 50000 to 50999 is easier to manage and is plenty for a small server. FileZilla's advice is to have more ports than the transfers that happen in a 4-minute period.
3. Public IP or hostname: leave it empty if the server's public IP address is set directly on its network adapter (check with ipconfig on Windows or ip addr on Linux). If the server is behind NAT, enter the public IP address or a host name that points to it.
4. Click Apply. Server › Network Configuration Wizard walks through the same settings step by step.

Open the firewall

Allow TCP port 21 and your passive range.

Windows (PowerShell as administrator):

New-NetFirewallRule -DisplayName "FileZilla Server" -Direction Inbound -Protocol TCP -LocalPort 21,50000-50999 -Action Allow

Ubuntu or Debian with UFW:

sudo ufw allow 21/tcp
sudo ufw allow 50000:50999/tcp

If a login works but directory listings time out, the passive range is not open or the public IP setting is wrong.

Use a trusted certificate (Let's Encrypt)

The self-signed certificate encrypts the connection, but FTP clients show a warning the first time. FileZilla Server can get and renew a free Let's Encrypt certificate itself:

1. Point a host name, for example ftp.example.com, to the server's IP address with a DNS A record.
2. In Protocols settings › FTP and FTP over TLS (FTPS), open the Connection security tab and select the Let's Encrypt certificate option. Click Set up Let's Encrypt options first the first time: enter a contact address (for example mailto:admin@example.com), accept the terms of service, and choose how the domain check is answered: FileZilla's built-in web server on port 80, or the folder of a web server that already runs on port 80.
3. Click Generate new, enter the host name and click Apply. Renewal is automatic.
4. Let's Encrypt always checks port 80, so allow it in the firewall when you use the built-in web server.

Connect with an FTP client

In the FileZilla client, open File › Site Manager and add a site with protocol FTP - File Transfer Protocol, encryption Require explicit FTP over TLS, the server's IP address or host name, and the user name and password you created. With the self-signed certificate, check the fingerprint and accept it once. More detail: configuring your website in FileZilla.

Troubleshooting

• "503" or "TLS required" on login: the client is using plain FTP. Set its encryption to require explicit FTP over TLS.
• Login works, listing times out: open the passive port range and check the public IP setting.
• Uploads fail with permission denied (Linux): the folder must be writable by the ftp account (sudo chown ftp:ftp /srv/ftp/webuser).

Need a server for it? A Windows VPS or a KVM VPS gives you full administrator or root access, or you can hire an expert to set it up for you.