PORTUnencryptedIANA assigned
Port 20FTP data (active mode)
Port 20 is the FTP data port: in active mode the server opens a connection from its port 20 to a port the client announced. In passive mode, which almost every modern client uses, port 20 is not involved and data flows to a high port on the server instead.
What port 20 is used for
In FTP's original design the server is the one that opens the data connection. After the client sends PORT h1,h2,h3,h4,p1,p2 on the control channel (port 21), the server connects from its own port 20 to the address and port the client gave. That worked on the 1980s internet where every host had a public address and no firewall.
Today the client is usually behind NAT and a firewall, so the server's inbound connection never arrives. Clients therefore use passive mode (PASV), in which the client opens the data connection to a high port on the server. In that arrangement port 20 is unused.
Why the port still matters
- Some servers still support active mode for old clients and scripts.
- Firewall rule sets that mention "FTP" often include 20, and understanding why prevents cargo-cult rules.
- Stateful firewalls with FTP application-layer inspection read the
PORT/PASVexchange on 21 and open the data path dynamically; without that inspection, active mode fails.
Security considerations
The same as FTP generally: no encryption unless FTPS protects the data channel with PROT P. A server initiating connections from port 20 to arbitrary client ports is also a classic way to bounce traffic, which is why servers should validate that the address in PORT matches the client.
Firewall considerations
Servers offering active mode need an outbound rule permitting connections from source port 20. Clients behind NAT should simply use passive mode and never need port 20 rules.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 20 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
Do I need to open port 20 on my firewall?
Only if you run an FTP server that supports active mode, and then as an outbound rule allowing connections with source port 20. Passive-mode-only servers never use it. Clients never need an inbound rule for port 20 unless they must accept active-mode connections, which is what NAT makes impractical.