Port 20 — FTP data

TCP well-known

What runs on port 20

The data channel of the classic File Transfer Protocol. The control channel is port 21.

Classic FTP uses two connections: commands on 21 and file contents on 20. In active mode the server opens the data connection back to the client from port 20, which is why active FTP breaks behind almost every NAT and firewall built since the 1990s — the inbound connection has nowhere to land. Passive mode was invented to fix this: the client opens both connections, and the server picks a high port for data instead. If FTP transfers hang after a successful login while the directory listing works, active versus passive is the first thing to check.

Security considerations

Unencrypted. Use SFTP (port 22) or FTPS instead — plain FTP sends credentials in clear text.

Checking whether something is listening

# Linux / macOS — what is bound to the port
sudo lsof -i :20
sudo ss -lntp | grep :20

# Windows
netstat -ano | findstr :20
Get-NetTCPConnection -LocalPort 20

# is it reachable from outside?
nc -zv example.com 20
curl -v telnet://example.com:20

Freeing the port

# find the process, then stop it
sudo lsof -ti :20 | xargs kill        # Linux / macOS
netstat -ano | findstr :20            # note the PID, then:
taskkill /PID <pid> /F                    # Windows

Should this port be open to the internet?

Usually not. Expose it only if a specific external client needs it, and restrict by source address where you can.

Opening or blocking port 20

Finding the port is usually the first half of the job. Start narrow — the second rule is there for services that genuinely serve the public, and most do not:

# ufw — Debian, Ubuntu
sudo ufw allow from 10.0.0.0/8 to any port 20 proto tcp
sudo ufw allow 20/tcp                   # only if it genuinely serves the public

# firewalld — RHEL, Fedora, CentOS
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=20 protocol=tcp accept'
sudo firewall-cmd --reload

# iptables, if you are still there
sudo iptables -A INPUT -p tcp --dport 20 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 20 -j DROP

# Windows
New-NetFirewallRule -DisplayName "FTP data 20" -Direction Inbound -Protocol TCP -LocalPort 20 -RemoteAddress 10.0.0.0/8 -Action Allow

10.0.0.0/8 stands in for a private range — substitute your own. Note that a firewall rule does not undo a service bound to 0.0.0.0; it only stops packets reaching it, and a misconfigured or disabled firewall then exposes it immediately.

Quick reference

Frequently asked questions

Other common ports

• Port 21 — FTP control
• Port 22 — SSH / SFTP
• Port 23 — Telnet
• Port 25 — SMTP
• Port 53 — DNS
• Port 67 — DHCP server
• Port 68 — DHCP client
• Port 69 — TFTP
• Port 80 — HTTP
• Port 110 — POP3
• Port 123 — NTP
• Port 143 — IMAP
• Port 161 — SNMP
• Port 389 — LDAP
• Port 443 — HTTPS
• Port 445 — SMB
• Port 465 — SMTPS
• Port 514 — Syslog

All port numbers