Port reference
Port 20 (TCP) – FTP Data
FTP active-mode data channel that carries file contents and directory listings.
Quick facts
- Transport
- tcp
- Category
- Well-known
- TLS
- Cleartext
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Opened on demand by an FTP server when a client requests active-mode transfers, alongside the control channel on port 21.
What is port 20 used for?
Port 20 is the FTP active-mode data channel, the connection that actually
carries file contents and directory listings for the File Transfer Protocol.
Commands and logins travel separately over port 21, and in active mode the server
opens this data connection from port 20 back to the client. It is used by classic
FTP servers like vsftpd, ProFTPD, and FileZilla Server, and by FTP clients such as
FileZilla and the ftp command-line tool.
When would you open it?
You would forward port 20 only when running an FTP server that needs active-mode transfers, for example a NAS or legacy upload service that clients reach across a firewall. Most modern setups use passive mode instead, so only open port 20 if you actually run an active-mode FTP server and clients require it.
Is it safe to open?
Plain FTP sends data unencrypted, so the safe approach is to use FTPS or SFTP, keep the service on a trusted network, and limit source IPs. See the security notes below.
How to check if this port is open
ss -tulpn | grep :20
nmap -p 20 <target>netstat -ano | findstr :20
Test-NetConnection <host> -Port 20lsof -i :20
nmap -p 20 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 20 to your device's local IP, internal port 20, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 20/tcpsudo firewall-cmd --permanent --add-port=20/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 20 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 20" -Direction Inbound -Protocol TCP -LocalPort 20 -Action AllowSecurity & risks
Use a secure alternative
This is a legacy or cleartext protocol. Prefer the encrypted equivalent:
Common attacks
- Cleartext capture of transferred files and directory listings
- FTP bounce attacks abusing the PORT command
- Man-in-the-middle tampering with downloaded data
- Firewall evasion through dynamically negotiated data ports
Hardening
- Replace plain FTP with SFTP (port 22) or FTPS (control 990)
- Prefer passive mode and pin a constrained passive port range
- Disable the FTP bounce / PORT-to-third-party behavior (default in modern daemons)
- Terminate FTP at a TLS-aware proxy and restrict source IPs
How to block this port
sudo ufw deny 20/tcpsudo firewall-cmd --permanent --remove-port=20/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 20 -j DROPNew-NetFirewallRule -DisplayName "Block 20" -Direction Inbound -Protocol TCP -LocalPort 20 -Action Blocknmap snippet
nmap -p20,21 --script ftp-anon,ftp-bounce,banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 20 used for?
- Port 20 is the FTP active-mode data channel. The server connects from port 20 back to the client to transfer file contents and directory listings, while commands flow over port 21.
- Is port 20 encrypted?
- No. Plain FTP data on port 20 is cleartext. Use SFTP or FTPS to encrypt transfers; otherwise files and any credentials in transit are exposed.