Port 21 — FTP control

TCP well-known

What runs on port 21

The command channel for FTP: login, directory listings and transfer commands.

Port 21 carries the control conversation only: USER, PASS, LIST, RETR, all in plain text and all readable by anything on the path. The greeting banner usually announces the server software and version, which is why scanners find and fingerprint FTP servers within hours of one appearing. FTPS adds TLS to this same port; SFTP is unrelated despite the name and runs over SSH on 22.

Security considerations

Credentials travel in clear text. Anything exposed to the internet on port 21 will be found by scanners within hours.

Checking whether something is listening

# Linux / macOS — what is bound to the port
sudo lsof -i :21
sudo ss -lntp | grep :21

# Windows
netstat -ano | findstr :21
Get-NetTCPConnection -LocalPort 21

# is it reachable from outside?
nc -zv example.com 21
curl -v telnet://example.com:21

Freeing the port

# find the process, then stop it
sudo lsof -ti :21 | xargs kill        # Linux / macOS
netstat -ano | findstr :21            # note the PID, then:
taskkill /PID <pid> /F                    # Windows

Should this port be open to the internet?

Usually not. Expose it only if a specific external client needs it, and restrict by source address where you can.

Opening or blocking port 21

Finding the port is usually the first half of the job. Start narrow — the second rule is there for services that genuinely serve the public, and most do not:

# ufw — Debian, Ubuntu
sudo ufw allow from 10.0.0.0/8 to any port 21 proto tcp
sudo ufw allow 21/tcp                   # only if it genuinely serves the public

# firewalld — RHEL, Fedora, CentOS
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=21 protocol=tcp accept'
sudo firewall-cmd --reload

# iptables, if you are still there
sudo iptables -A INPUT -p tcp --dport 21 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 21 -j DROP

# Windows
New-NetFirewallRule -DisplayName "FTP control 21" -Direction Inbound -Protocol TCP -LocalPort 21 -RemoteAddress 10.0.0.0/8 -Action Allow

10.0.0.0/8 stands in for a private range — substitute your own. Note that a firewall rule does not undo a service bound to 0.0.0.0; it only stops packets reaching it, and a misconfigured or disabled firewall then exposes it immediately.

Quick reference

Frequently asked questions

Other common ports

• Port 22 — SSH / SFTP
• Port 23 — Telnet
• Port 25 — SMTP
• Port 53 — DNS
• Port 67 — DHCP server
• Port 68 — DHCP client
• Port 69 — TFTP
• Port 80 — HTTP
• Port 110 — POP3
• Port 123 — NTP
• Port 143 — IMAP
• Port 161 — SNMP
• Port 389 — LDAP
• Port 443 — HTTPS
• Port 445 — SMB
• Port 465 — SMTPS
• Port 514 — Syslog
• Port 587 — SMTP submission

All port numbers