Port 21 (FTP (control))

File Transfer Protocol control channel. Data moves on a separate connection: port 20 in active mode or a negotiated high port in passive mode.

Well-known (system) port, 0-1023 TCP File transfer and storage Expose only to trusted sources

What port 21 is used for

File Transfer Protocol control channel. Data moves on a separate connection: port 20 in active mode or a negotiated high port in passive mode.

Security: should port 21 be open?

Expose only to trusted sources. Plain FTP sends usernames and passwords in clear text. Prefer SFTP (over SSH, port 22) or FTPS. If you must run FTP, disable anonymous login and limit the passive port range in the firewall. Anonymous FTP servers are often found leaking files.

IANA assignment

Service nameProtoDescriptionAssigneeReference

ftp TCP File Transfer Protocol [Control]
Defined TXT keys: u=<username> p=<password> path=<path> Jon Postel RFC 959

ftp UDP File Transfer Protocol [Control]
Defined TXT keys: u=<username> p=<password> path=<path> Jon Postel RFC 959

ftp SCTP FTP
Defined TXT keys: u=<username> p=<password> path=<path> Randall Stewart RFC 9260

Registry dates for this port: last modified 2022-02-07.

Check what is listening on port 21

Linux: is anything listening on TCP 21?

sudo ss -tlnp 'sport = :21'

Linux / macOS: which process owns the port

sudo lsof -nP -i :21

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':21 '

Windows (Command Prompt)

netstat -ano | findstr :21

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 21 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 21

From Windows

Test-NetConnection HOST -Port 21

Allow only trusted sources on port 21 in the firewall

Replace 203.0.113.10 with the address or network you trust. With ufw, make sure the default incoming policy is deny.

ufw (one trusted source)

sudo ufw allow from 203.0.113.10 to any port 21 proto tcp

iptables

sudo iptables -A INPUT -p tcp --dport 21 -s 203.0.113.10 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 21 -j DROP

nftables

sudo nft add rule inet filter input ip saddr 203.0.113.10 tcp dport 21 accept
sudo nft add rule inet filter input tcp dport 21 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'TCP 21 trusted' -Direction Inbound -Protocol TCP -LocalPort 21 -RemoteAddress 203.0.113.10 -Action Allow

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.