Port 21 — FTP (TCP)
What is Port 21?
File Transfer Protocol (Kontrola)
This is a well-known port (0–1023) commonly used by core services like FTP. · RFC 959
When do you need Port 21 open?
Open only if you are running an FTP server for file transfers. Most modern setups prefer SFTP (port 22) or FTPS, which encrypt credentials and data in transit. Close port 21 if no FTP server is active.
Common uses and software
- FileZilla Server
- vsftpd
- Pure-FTPd
- ProFTPD
Security
FTP sends all credentials and data in plain text. Any attacker with network access can capture usernames and passwords. Block port 21 and replace with SFTP (port 22). If FTP is unavoidable, use FTPS with implicit TLS and restrict access to known client IPs.
Is Port 21 safe?
An open port increases your attack surface. Safety depends on how FTP is configured.
This port is actively targeted by automated attacks. Keep it closed unless FTP is actively required, and restrict access to known IP ranges in your firewall.
Test connectivity for Port 21 on any host.
How to Open Port 21
To allow incoming connections to Port 21 (FTP) from outside your network, configure your firewall and add a port forwarding rule on your router pointing to your device's local IP address.
Open Windows Defender Firewall → Advanced Settings → Inbound Rules → New Rule → Port → TCP → Specific local ports: 21 → Allow the connection → Name and save the rule.
netsh advfirewall firewall add rule name="Open Port 21" dir=in action=allow protocol=tcp localport=21sudo ufw allow 21/tcpsudo iptables -A INPUT -p tcp --dport 21 -j ACCEPTLog into your router (192.168.1.1 or 192.168.0.1) → Port Forwarding → Add a new rule: Protocol TCP, External port 21, Internal IP: your device's local IP, Internal port 21 → Save.
How to close Port 21
If you do not need FTP, block this port in your firewall or router.
To block port 21 on Windows, run the following command in PowerShell or Command Prompt (as Administrator):
netsh advfirewall firewall add rule name="Block Port 21" dir=in action=block protocol=tcp localport=21sudo ufw deny 21/tcpsudo iptables -A INPUT -p tcp --dport 21 -j DROPRemove or disable any port forwarding rule for Port 21.
Frequently Asked Questions
What is Port 21 used for?▾
Port 21 is the default TCP port for FTP. It is used by servers and applications that need to accept incoming connections for this service. Whether you need it open depends on whether you are actively running a FTP server — if not, it should remain closed to reduce your attack surface.
Is Port 21 safe to keep open?▾
An open Port 21 increases your attack surface. If you are not actively running FTP, close this port in your firewall and remove any port forwarding rules. If FTP must be accessible, restrict access to known IP ranges, keep the service software updated with security patches, and use strong authentication.