Skip to content
Webmaster Tools
SecurityPort ScannerPort 21 (FTP)

Port 21 (FTP)

Port 21 is the FTP control port. What runs there, why plain FTP is unsafe, active vs passive mode, how to firewall it and what to use instead (SFTP, FTPS).

What runs on port 21

TCP port 21 is the control connection of FTP, the File Transfer Protocol (RFC 959). The client connects to 21 and sends commands such as USER, PASS, LIST and RETR. The files themselves travel over a separate data connection on another port. Plain FTP is unencrypted: the username, the password and every file cross the network in clear text.

Active and passive mode

FTP needs a second connection for each transfer or directory listing, which is why it fights with firewalls and NAT.

Mode Who opens the data connection Ports involved
Active (PORT) The server connects back to the client, from port 20 21 in, 20 out to a client port
Passive (PASV/EPSV) The client connects to the server 21 plus a range of high ports on the server

Almost every client uses passive mode today. On the server you pick a fixed passive range and open it in the firewall. In vsftpd:

pasv_enable=YES
pasv_min_port=40000
pasv_max_port=40100
ssl_enable=YES
force_local_logins_ssl=YES
force_local_data_ssl=YES

The ssl_* lines turn on explicit FTPS: the client connects to 21 and upgrades with AUTH TLS. Implicit FTPS, where TLS starts immediately, uses port 990 instead.

Should it be open to the internet?

Usually not. If you only need to move files to your own server, use SFTP, which runs inside SSH on port 22 and needs no extra ports. Keep port 21 open only if partners or devices can speak nothing but FTP, and then require TLS (FTPS) and limit who can connect:

# ufw: allow FTP only from one partner network
sudo ufw allow from 203.0.113.0/24 to any port 21 proto tcp
sudo ufw allow from 203.0.113.0/24 to any port 40000:40100 proto tcp

# iptables equivalent
iptables -A INPUT -p tcp -s 203.0.113.0/24 --dport 21 -j ACCEPT
iptables -A INPUT -p tcp -s 203.0.113.0/24 --dport 40000:40100 -j ACCEPT

See what is listening

sudo ss -tlnp 'sport = :21'
sudo lsof -i :21

If the port is taken by a server you did not mean to run (a forgotten ProFTPD, Pure-FTPd or a control panel's bundled FTP server), stop and disable it, for example sudo systemctl disable --now vsftpd, rather than just blocking it.

Security notes

  • Passwords in clear text. Anyone on the path (shared Wi-Fi, a compromised router) can read them. Plain FTP credentials should be treated as exposed.
  • Brute force. Bots scan port 21 constantly and try common usernames. Use fail2ban or an allowlist.
  • Anonymous FTP. Make sure anonymous_enable=NO unless you really run a public download server, and never allow anonymous uploads.
  • Banner leaks. The greeting often shows the server name and version; set a neutral banner (ftpd_banner in vsftpd).
  • Data port range. A wide passive range opened to everyone widens the attack surface; keep it small.

To see whether port 21 is reachable on your server from the public internet, run the Port Scanner against your host.