Port 21 (FTP): Uses and Security

What uses port 21

Port 21 carries FTP commands such as USER, PASS, LIST and RETR. Plain FTP sends usernames, passwords and files unencrypted, so anyone on the path can read them. For new setups, use SFTP (file transfer over SSH, port 22) or FTPS (FTP over TLS, explicit on port 21 with AUTH TLS, or implicit on 990).

Should port 21 be open to the internet?

Restrict access. Only open this port to known networks or users, for example your office IP, a VPN or behind authentication.

Port 21 open but transfers fail usually means passive mode ports are blocked; see port 20.
Anonymous FTP servers on the internet are scanned constantly. Disable anonymous login unless you really serve public files.

Check what is listening on port 21

Linux

sudo ss -ltnp 'sport = :21'

macOS

sudo lsof -nP -iTCP:21 -sTCP:LISTEN

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 21 -State Listen
netstat -ano | findstr :21

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 21

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

macOS / Linux

sudo kill $(sudo lsof -t -iTCP:21 -sTCP:LISTEN)

Windows (PowerShell)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 21 -State Listen).OwningProcess

Allow port 21 from trusted networks only

The examples allow 21 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

Ubuntu / Debian (ufw)

sudo ufw allow from 10.0.0.0/8 to any port 21 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 21 proto tcp

RHEL / Fedora / Rocky (firewalld)

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="21" protocol="tcp" accept'
sudo firewall-cmd --reload

Windows (PowerShell, as administrator)

New-NetFirewallRule -DisplayName "FTP 21/TCP" -Direction Inbound -Protocol TCP -LocalPort 21 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 21 from another machine

macOS / Linux

nc -zv example.com 21

Windows (PowerShell)

Test-NetConnection example.com -Port 21

Related ports

Port 20 (FTP data): the data channel of FTP in active mode.
Port 22 (SSH): used by SSH for secure remote logins, SFTP, SCP and Git over SSH.
Port 990 (FTPS): used by FTPS in implicit TLS mode.

More file sharing ports

69 (TFTP) , 139 (NetBIOS Session) , 445 (SMB) , 873 (rsync) , 2049 (NFS) . See all ports in the port lookup.

Sources

IANA port registry: 21

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 21 used for?

Port 21 is the control port of FTP, the File Transfer Protocol. Port 21 carries FTP commands such as USER, PASS, LIST and RETR. Plain FTP sends usernames, passwords and files unencrypted, so anyone on the path can read them. For new setups, use SFTP (file transfer over SSH, port 22) or FTPS (FTP over TLS, explicit on port 21 with AUTH TLS, or implicit on 990).

Is it safe to open port 21?

Only open this port to known networks or users, for example your office IP, a VPN or behind authentication. Allow it only from the networks that need it, as in the firewall examples on this page.

How do I check if port 21 is open?

On the server, list listening sockets with "sudo ss -ltnp 'sport = :21'" on Linux or "sudo lsof -nP -i :21" on macOS. From another machine, run "nc -zv host 21" or, on Windows, "Test-NetConnection host -Port 21". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.