Port reference
Port 21 (TCP) – FTP Control
FTP command and authentication channel for browsing and transferring files.
Quick facts
- Transport
- tcp
- Category
- Well-known
- TLS
- Cleartext
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Open on FTP servers and many NAS, routers, and legacy appliances; frequently exposed to the internet.
What is port 21 used for?
Port 21 is the FTP control channel, the connection that carries File Transfer
Protocol commands, server replies, and the login exchange. A client connects here
to authenticate and issue commands like LIST, RETR, and STOR, while the file
bytes themselves travel over a separate data connection. It is one of the oldest
internet protocols and is still served by software like vsftpd, ProFTPD, and
FileZilla Server, reached with clients such as FileZilla, WinSCP, or a web browser,
and it is built into many NAS boxes and routers.
When would you open it?
You open port 21 when you host an FTP server and want users to log in and transfer files, for example sharing files from a home NAS or running an upload drop for a small team. Only forward it if you genuinely run an FTP service and need remote access to it.
Is it safe to open?
Plain FTP sends logins in cleartext, so the safe approach is to enforce FTPS or switch to SFTP, disable anonymous access, and restrict by source IP or keep it behind a VPN. See the security notes below.
How to check if this port is open
ss -tulpn | grep :21
nmap -p 21 <target>netstat -ano | findstr :21
Test-NetConnection <host> -Port 21lsof -i :21
nmap -p 21 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 21 to your device's local IP, internal port 21, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 21/tcpsudo firewall-cmd --permanent --add-port=21/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 21 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 21" -Direction Inbound -Protocol TCP -LocalPort 21 -Action AllowSecurity & risks
Use a secure alternative
This is a legacy or cleartext protocol. Prefer the encrypted equivalent:
Common attacks
- Cleartext credential capture via sniffing
- Anonymous FTP access and writable upload directories
- Credential brute force and password spraying
- FTP bounce abuse via the PORT command
Hardening
- Replace FTP with SFTP (port 22) or enforce FTPS (explicit FTPS on 21 or implicit on 990)
- Disable anonymous login unless a read-only public mirror is intended
- Enforce TLS for both control and data channels; reject cleartext logins
- Add rate limiting / fail2ban and restrict by source IP
How to block this port
sudo ufw deny 21/tcpsudo firewall-cmd --permanent --remove-port=21/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 21 -j DROPNew-NetFirewallRule -DisplayName "Block 21" -Direction Inbound -Protocol TCP -LocalPort 21 -Action Blocknmap snippet
nmap -p21 --script ftp-anon,ftp-bounce,ftp-syst,banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is port 21 secure?
- No. Plain FTP on port 21 sends usernames and passwords in cleartext. Use SFTP or enforce FTPS so credentials and commands are encrypted.
- What is anonymous FTP on port 21?
- Many FTP servers allow login as 'anonymous' with no real password. If misconfigured with writable directories it lets attackers read or plant files, so disable it unless a public read-only mirror is intended.