Port 20/21: FTP and its firewall pitfalls

FTP uses port 21 for commands and port 20 (active mode) or a passive port range for data transfers.

Port: 20-21
Protocol: TCP
Service: FTP
Exposure: Public: only if required, prefer SFTP

daniele@mikweb: ~/ports — less 20-21.md

Port 21 carries the FTP control channel; port 20 is only used for data in active mode. Almost every client uses passive mode today, where the server opens a port from a configured range, e.g. pasv_min_port=40000 and pasv_max_port=40100 in vsftpd.

Plain FTP sends passwords in clear text. If FTP must be public, use FTPS (AUTH TLS on port 21) and open the passive range in the firewall. Better: SFTP over port 22.

Typical problem: login works but LIST hangs or times out. The cause is almost always a blocked passive range or a wrong pasv_address behind NAT.

Check

nc -vz ftp.example.com 21