Port 21: FTP
TCP 21 is the port for File Transfer Protocol (control channel). Only if you must serve legacy clients, and then with FTPS. Plain FTP exposes passwords.
| Service | File Transfer Protocol (control channel) |
|---|---|
| Protocol | TCP |
| Exposure risk | High: do not expose to the internet |
| Secure alternative | SFTP (port 22) or FTPS (implicit TLS on 990, or explicit AUTH TLS on 21) |
| Range | Well-known (0–1023): binding needs root/admin on Unix |
What port 21 does
Clients connect to port 21 to log in and send FTP commands. File data then flows on port 20 (active) or a negotiated high port (passive), so firewalls must also allow the passive range configured on the server.
Should port 21 be open?
Only if you must serve legacy clients, and then with FTPS. Plain FTP exposes passwords. Where you can, use SFTP (port 22) or FTPS (implicit TLS on 990, or explicit AUTH TLS on 21) instead.
Find what's listening on port 21
- Linux:
sudo ss -tulpn | grep :21 - macOS:
sudo lsof -nP -i :21 - Windows:
netstat -ano | findstr :21, then look up the PID in Task Manager.
Open or block it in a firewall
- ufw:
sudo ufw allow 21/tcp(ordeny) - firewalld:
sudo firewall-cmd --add-port=21/tcp --permanent && sudo firewall-cmd --reload - Windows:
New-NetFirewallRule -DisplayName "Port 21" -Direction Inbound -Protocol TCP -LocalPort 21 -Action Allow
Port assignment per the IANA Service Name and Transport Protocol Port Number Registry. Test several ports at once with the port scanner, or any port with the open port checker.
Questions about port 21
What is port 21 used for?
File Transfer Protocol (control channel). Clients connect to port 21 to log in and send FTP commands. File data then flows on port 20 (active) or a negotiated high port (passive), so firewalls must also allow the passive range configured on the server.
Is port 21 TCP or UDP?
TCP. FTP uses TCP port 21.
Is it safe to open port 21?
High: do not expose to the internet. Only if you must serve legacy clients, and then with FTPS. Plain FTP exposes passwords. Secure alternative: SFTP (port 22) or FTPS (implicit TLS on 990, or explicit AUTH TLS on 21).
How do I check if port 21 is open?
Use the checker on this page: it connects to your host on TCP 21 from the internet. Locally, run
nc -vz host 21 (macOS/Linux) or Test-NetConnection host -Port 21 (PowerShell). To see what is listening on your own machine, run ss -tulpn | grep :21 (Linux) or netstat -ano | findstr :21 (Windows).