Port reference
Port 990 (TCP) – FTPS (implicit TLS)
FTP over implicit TLS — the control channel is wrapped in TLS from connect, unlike explicit FTPS (AUTH TLS) on port 21.
Quick facts
- Transport
- tcp
- Category
- Well-known
- TLS
- Encrypted
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on FTP servers configured for implicit FTPS. Often internet-facing for file exchange with partners.
What is port 990 used for?
Port 990 carries FTPS using implicit TLS, meaning the FTP connection is encrypted with TLS from the instant it opens. It is the secure version of classic FTP file transfer, used by clients like FileZilla and WinSCP and by servers such as vsftpd and FileZilla Server. It differs from explicit FTPS on port 21, where a plain session is upgraded later with the AUTH TLS command.
When would you open it?
You open port 990 if you run an FTPS server and need to exchange files with partners or clients over encrypted FTP. A common scenario is a vsftpd or FileZilla Server set up for implicit TLS so remote users can upload and download securely. Only open it if you actually operate that server, and remember FTPS also needs passive data ports.
Is it safe to open?
The main risk is weak TLS settings or guessable logins exposing your files, so require TLS 1.2+, strong unique passwords, and consider SFTP instead. See the security notes below.
How to check if this port is open
ss -tulpn | grep :990
nmap -p 990 <target>netstat -ano | findstr :990
Test-NetConnection <host> -Port 990lsof -i :990
nmap -p 990 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 990 to your device's local IP, internal port 990, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 990/tcpsudo firewall-cmd --permanent --add-port=990/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 990 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 990" -Direction Inbound -Protocol TCP -LocalPort 990 -Action AllowSecurity & risks
Common attacks
- Credential brute force and reuse of leaked logins
- Weak/legacy TLS (SSLv3/TLS 1.0), bad ciphers and certificates
- Data-channel exposure and firewall/NAT mishandling of FTP passive ports
- Anonymous access and over-permissive file/directory permissions
Hardening
- Require TLS 1.2+ with strong ciphers and a valid certificate
- Disable anonymous login; enforce strong, unique credentials and MFA where possible
- Restrict and firewall the passive data-port range explicitly
- Prefer SFTP (SSH, port 22) for new deployments where feasible
- Lock down file permissions; log and rate-limit auth attempts
How to block this port
sudo ufw deny 990/tcpsudo firewall-cmd --permanent --remove-port=990/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 990 -j DROPNew-NetFirewallRule -DisplayName "Block 990" -Direction Inbound -Protocol TCP -LocalPort 990 -Action Blocknmap snippet
nmap -p990 --script ssl-enum-ciphers,ssl-cert <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the difference between port 990 and port 21 FTPS?
- Port 990 is implicit FTPS — TLS is negotiated immediately on connect. Port 21 uses explicit FTPS (AUTH TLS), upgrading a plaintext FTP session. Both protect FTP, but implicit is the legacy approach on 990.
- Is FTPS on 990 secure?
- TLS protects credentials and data in transit, but FTPS still inherits FTP's awkward data channels and weak-password risks. Enforce TLS 1.2+, disable anonymous access, and consider SFTP instead.