Port 21 FTP · TCP

What runs on port 21

FTP control channel. Usernames, passwords and commands cross the wire in plaintext unless the connection is upgraded with AUTH TLS (explicit FTPS); implicit FTPS uses port 990 instead. FTP is still common for web hosting panels and legacy B2B transfers, and still a frequent finding in security audits.

Software that uses it: vsftpd · ProFTPD · Pure-FTPd · FileZilla Server · IIS FTP

Should port 21 be open?

Disable it. This is a legacy or insecure protocol. The recommendation is not to firewall it but to turn the service off and use the modern replacement.

• Passive mode needs a defined port range (for example 50000–50100) opened on the firewall as well.
• Replace with SFTP where you can: one port, key authentication, encrypted by default.

Check port 21

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :21'
sudo lsof -i :21

# from another machine: is it reachable?
nc -zv host 21
nmap -p 21 host
curl -v telnet://host:21      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 21

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 21 proto tcp
sudo ufw deny 21/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 21 accept
nft add rule inet filter input tcp dport 21 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 21 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=21 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 21" with no source is just "open".

Related ports

• 20 FTP data — FTP data channel (active mode)
• 22 SSH — SSH, SCP, SFTP, git over ssh
• 990 FTPS (implicit) — FTP over TLS from the first byte
• 873 rsync — rsync daemon

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions