Port 21FTP control

What port 21 is used for

FTP separates commands from data. The client opens a TCP connection to port 21, logs in with USER and PASS, and issues commands such as LIST, RETR and STOR. Each file transfer or directory listing then uses a second connection:

Nearly all modern clients default to passive mode because NAT and client firewalls block the server's inbound connection in active mode.

Encryption

Plain FTP has none: the username, password, commands and file contents are all visible on the network. Two fixes exist:

• FTPS — TLS negotiated on port 21 (AUTH TLS, explicit FTPS) or wrapped from the first byte on port 990 (implicit FTPS). The data channel is protected separately (PROT P).
• SFTP — not FTP at all, but a file-transfer subsystem of SSH on port 22. One port, always encrypted, simpler firewall rules.

Security considerations

• Plain FTP across any untrusted network exposes credentials. Treat it as obsolete for anything but anonymous public downloads.
• Anonymous FTP with write access is an open file drop. Disable anonymous uploads.
• Passive port ranges must be firewalled deliberately. Define a narrow range on the server (for example 50000–50100) and allow only that range inbound.
• Brute-force attacks on 21 are constant. Use account lockout, fail2ban-style blocking and strong passwords, or move to SFTP with keys.

How to check port 21

Is something listening locally? On Windows, open Command Prompt and run:

netstat -ano | findstr :21

A line in the LISTENING state means a local program has bound port 21; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :21 or lsof -i :21.

Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:

Test-NetConnection ftp.example.com -Port 21

TcpTestSucceeded : True means the remote system accepted a TCP connection on port 21. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.

See the netstat and Test-NetConnection records for the full option sets.

Test a login and listing with curl (this sends the password in clear text unless you use --ssl-reqd):

curl --ssl-reqd -u user:password ftp://ftp.example.com/

Firewall considerations

FTP servers need inbound 21 plus their passive range (and outbound from port 20 if active mode is supported). Clients need nothing inbound in passive mode. If you run an FTP server behind NAT, the server must be told its public address so PASV replies contain something clients can reach.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 21 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.