Port 20 (FTP (data, active mode))

Source port of the FTP data connection in active mode, where the server connects back to the client.

Well-known (system) port, 0-1023 TCP File transfer and storage Expose only to trusted sources

What port 20 is used for

Source port of the FTP data connection in active mode, where the server connects back to the client.

Security: should port 20 be open?

Expose only to trusted sources. Active mode breaks behind NAT and needs inbound connections to the client, so most clients use passive mode instead. Only needed if you run an FTP server.

IANA assignment

Service nameProtoDescriptionAssigneeReference

ftp-data TCP File Transfer [Default Data] Jon Postel -

ftp-data UDP File Transfer [Default Data] Jon Postel -

ftp-data SCTP FTP Randall Stewart RFC 9260

Registry dates for this port: last modified 2022-02-07.

Check what is listening on port 20

Linux: is anything listening on TCP 20?

sudo ss -tlnp 'sport = :20'

Linux / macOS: which process owns the port

sudo lsof -nP -i :20

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':20 '

Windows (Command Prompt)

netstat -ano | findstr :20

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 20 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 20

From Windows

Test-NetConnection HOST -Port 20

Allow only trusted sources on port 20 in the firewall

Replace 203.0.113.10 with the address or network you trust. With ufw, make sure the default incoming policy is deny.

ufw (one trusted source)

sudo ufw allow from 203.0.113.10 to any port 20 proto tcp

iptables

sudo iptables -A INPUT -p tcp --dport 20 -s 203.0.113.10 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 20 -j DROP

nftables

sudo nft add rule inet filter input ip saddr 203.0.113.10 tcp dport 20 accept
sudo nft add rule inet filter input tcp dport 20 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'TCP 20 trusted' -Direction Inbound -Protocol TCP -LocalPort 20 -RemoteAddress 203.0.113.10 -Action Allow

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.