How to Fix FTP Connection Timeout in Plesk with Cloudflare DNS Make it Rain Paper

Pre-requirements

• Plesk Obsidian running on a Linux-based operating system.
• Access to the Cloudflare DNS management panel.
• Basic knowledge of DNS records and FTP configuration.
• Administrator access to the Plesk control panel.

Introduction

If your website is using Cloudflare nameservers and FTP traffic is being blocked, you may encounter FTP connection timeouts in Plesk. This happens because Cloudflare does not proxy FTP traffic. In this guide, we will show you how to configure a separate DNS record that bypasses Cloudflare's proxy and allows FTP access.

Step 1: Identify the Problem with FTP and Cloudflare

When trying to connect to an FTP server using a domain name that is proxied through Cloudflare, you might receive the following error:

connect to 123.456.789.012 port 21 failed: Connection timed out
Trying 123.456.789.012:21...

Additionally, if you're attempting to migrate a site using the Site Import extension in Plesk, the debug log may display errors similar to:

MigrationError: Failed to connect to source domain
Cause: timed out

Why This Happens

The reason for these errors is that Cloudflare's DNS service does not proxy FTP traffic. Only certain HTTP and HTTPS ports are compatible with Cloudflare's proxy, as mentioned in their documentation.

Step 2: Create a New DNS Record for FTP Traffic

To resolve the issue, you need to create a new DNS record (e.g., ftp.example.com) in Cloudflare and configure it to bypass Cloudflare's proxy. Here’s how:

1. Log into your Cloudflare account and select your domain.
2. Navigate to the DNS tab.
3. Click Add Record.
4. Set the Type to A, and in the Name field, enter ftp (for ftp.example.com).
5. In the IPv4 Address field, enter your Plesk server's IP address (e.g., 123.456.789.012).
6. Under the Proxy status, set it to DNS only (gray cloud icon) to bypass Cloudflare's proxy for this record.
7. Click Save.

Gotchas to Avoid

• Ensure that you are using the correct IP address for your Plesk server when creating the A record.
• If you continue using example.com for FTP, you will face the same issue, as it will be proxied by Cloudflare. Always use ftp.example.com for FTP traffic.

Step 3: Update FTP Client to Use the New DNS Record

After creating the DNS record for ftp.example.com, configure your FTP client to connect using this new subdomain instead of the proxied domain. For example, instead of connecting to example.com, use ftp.example.com in your FTP client settings.

Linux Command to Test FTP Connection

# Test FTP connection using the new DNS record
ftp ftp.example.com

If the connection is successful, you should be able to log in without timeout errors.

Step 4: Verify DNS Changes

It's important to ensure that the new DNS record is properly propagated. You can verify this using the dig command:

Linux Commands to Verify DNS Record

# Verify that ftp.example.com resolves correctly
dig A ftp.example.com

Check that the record resolves to the correct IP address and is not proxied through Cloudflare (the TTL should match your DNS-only setting).

Step 5: Confirm Successful FTP Connection

Once the new DNS record is propagated, your FTP connection should be successful without the Cloudflare proxy interference. Test the connection again using your preferred FTP client, or use the Linux command below:

Linux Command to Confirm FTP Connection

ftp ftp.example.com

You should be able to connect and transfer files without encountering any timeouts.

Additional Cloudflare Resources

• Proxy Status and Ports Supported by Cloudflare
• How to Create DNS Records in Cloudflare
• Allowed Network Ports for HTTP/HTTPS Traffic

Gotchas to Avoid

• Ensure that the ftp.example.com record is set to DNS only. If it's proxied (orange cloud), FTP traffic will still be blocked.
• Wait for DNS propagation after creating the new record. This may take a few minutes to several hours depending on your DNS settings.
• If you are migrating a site using Plesk's Site Import extension, ensure that the source FTP server is accessible via the new DNS record before starting the migration process again.

By creating a new ftp.example.com DNS record and setting it to bypass Cloudflare's proxy, you can resolve FTP connection timeout issues when using Plesk and Cloudflare. Always ensure that FTP traffic is routed through a DNS-only record to avoid Cloudflare's limitations on non-HTTP/HTTPS traffic.

For more detailed guidance on Cloudflare settings, visit our Knowledge Base.