Port 20 FTP data · TCP

What runs on port 20

In active-mode FTP the server opens the data connection from its own port 20 back to the client. That design breaks through NAT and stateful firewalls, which is why nearly all FTP today is passive mode, where the data port is a random high port on the server instead. Port 20 therefore shows up mostly in firewall rules and old documentation.

Software that uses it: vsftpd · ProFTPD · Pure-FTPd · IIS FTP

Should port 20 be open?

Disable it. This is a legacy or insecure protocol. The recommendation is not to firewall it but to turn the service off and use the modern replacement.

• If a client cannot list directories, the active/passive mode mismatch is the usual cause.
• Prefer SFTP (port 22) or FTPS for anything new.

Check port 20

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :20'
sudo lsof -i :20

# from another machine: is it reachable?
nc -zv host 20
nmap -p 20 host
curl -v telnet://host:20      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 20

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 20 proto tcp
sudo ufw deny 20/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 20 accept
nft add rule inet filter input tcp dport 20 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 20 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 20 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=20 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 20" with no source is just "open".

Related ports

• 21 FTP — FTP control; plaintext, replace with SFTP
• 22 SSH — SSH, SCP, SFTP, git over ssh
• 990 FTPS (implicit) — FTP over TLS from the first byte

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions