What uses port 990
Implicit FTPS starts TLS immediately on port 990, in contrast to explicit FTPS, which connects to port 21 and upgrades with AUTH TLS. Explicit mode is more common today. Either way, the passive data ports must also be open, and they are encrypted too, which means firewalls can’t inspect them to open ports automatically.
Should port 990 be open to the internet?
Restrict access. Only open this port to known networks or users, for example your office IP, a VPN or behind authentication.
Check what is listening on port 990
sudo ss -ltnp 'sport = :990'sudo lsof -nP -iTCP:990 -sTCP:LISTENGet-NetTCPConnection -LocalPort 990 -State Listen
netstat -ano | findstr :990No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.
Fix “address already in use” on port 990
Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:
sudo kill $(sudo lsof -t -iTCP:990 -sTCP:LISTEN)Stop-Process -Id (Get-NetTCPConnection -LocalPort 990 -State Listen).OwningProcessAllow port 990 from trusted networks only
The examples allow 990 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.
sudo ufw allow from 10.0.0.0/8 to any port 990 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 990 proto tcpsudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="990" protocol="tcp" accept'
sudo firewall-cmd --reloadNew-NetFirewallRule -DisplayName "FTPS 990/TCP" -Direction Inbound -Protocol TCP -LocalPort 990 -Action Allow -RemoteAddress 10.0.0.0/8On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.
Test port 990 from another machine
nc -zv example.com 990Test-NetConnection example.com -Port 990Related ports
- Port 21 (FTP): the control port of FTP, the File Transfer Protocol.
- Port 20 (FTP data): the data channel of FTP in active mode.
- Port 22 (SSH): used by SSH for secure remote logins, SFTP, SCP and Git over SSH.
More file sharing ports
69 (TFTP) , 139 (NetBIOS Session) , 445 (SMB) , 873 (rsync) , 2049 (NFS) . See all ports in the port lookup.
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What is port 990 used for?
Port 990 is used by FTPS in implicit TLS mode. Implicit FTPS starts TLS immediately on port 990, in contrast to explicit FTPS, which connects to port 21 and upgrades with AUTH TLS. Explicit mode is more common today. Either way, the passive data ports must also be open, and they are encrypted too, which means firewalls can’t inspect them to open ports automatically.
Is it safe to open port 990?
Only open this port to known networks or users, for example your office IP, a VPN or behind authentication. Allow it only from the networks that need it, as in the firewall examples on this page.
How do I check if port 990 is open?
On the server, list listening sockets with "sudo ss -ltnp 'sport = :990'" on Linux or "sudo lsof -nP -i :990" on macOS. From another machine, run "nc -zv host 990" or, on Windows, "Test-NetConnection host -Port 990". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.