You decide which services we may enable for analytics, personalization, and external content.
We use cookies and similar technologies on our website to personalize content, embed external media, and better understand how individual areas are used.
Necessary cookies
These entries support essential functions such as security, stability, and form processing.
Optional sections
Your data may be processed with your consent or on the basis of legitimate interests. In the cookie settings, you can reject or explicitly allow each optional category.
Some services process personal data in third countries. By consenting, you also agree to this transfer. You can find more information in our Privacy Policy.
You can reopen and change your selection at any time. · 1.0.2
Port 21 is the control channel for the File Transfer Protocol (FTP). Here you’ll find key details about the port and firewall commands to allow or block FTP.
Built by Justin Schuessler
Try the commands on your own VPS, with root access and your own firewall.
Add multiple ports one at a time, up to 12.
File transfer · Well-known port · OSI layer 7
FTP control channel: authentication and commands. Unencrypted; use SFTP over port 22 or FTPS instead.
IANA: officially registered as ftp
Firewall commands
Open port
sudo ufw allow 21/tcpFor Ubuntu and Debian. ufw creates the rule for both IPv4 and IPv6. If ufw is disabled, allow SSH first (sudo ufw allow 22/tcp), then enable it with sudo ufw enable, or you'll lock yourself out.
On a ZAP-Hosting VPS with an active network firewall, you also need to allow the port in the Customer Panel.
Port 21 explained
FTP transfers files between a client and server using two connections. Port 21 carries logins and commands, while the files themselves travel over a separate data channel. In active mode, the server establishes the data connection from port 20 to the client. In passive mode, which is common today, the client connects to a high-numbered port specified by the server, so you must also allow that port range through the firewall.
FTP is one of the internet’s oldest protocols. Its first specification was RFC 114 in 1971; the version still in use today is RFC 959 from 1985. FTPS, the TLS-encrypted variant, is described in RFC 4217. IANA lists port 21 as “ftp” and port 20 as “ftp-data”.
Traditional FTP sends usernames, passwords, and files without encryption. Anyone who can intercept the traffic can read your credentials in plain text. Use SFTP whenever possible: it runs over SSH on port 22 and needs no additional port. If you must offer FTP, require FTPS with TLS, confine users to their own directories, and disable anonymous access. For passive mode, open only a small, fixed port range rather than all high-numbered ports.
More ports
These ports are often part of the same setup. Click one to see its explanation and firewall commands.
View all well-known ports and the complete IANA list
Port list source: IANA Service Name and Transport Protocol Port Number Registry, as of October 22, 2026. iana.org
Discover more
Calculate the network address, broadcast address, subnet mask, and usable host range from a CIDR address, and convert between CIDR and IP ranges (IPv4 and IPv6).
Built by Jakub Martyniak
Interactively learn the 7 layers of the OSI model: click layers, assign terms such as switch, ARP, or port 443, and explore animated encapsulation, a quiz, and a cheat sheet for the IHK exam.
Built by Justin Schuessler
Interactively learn the 4 layers of the TCP/IP model (DoD model) according to RFC 1122, with OSI model mapping, animated encapsulation, a port quiz, and a cheat sheet.
Built by Justin Schuessler
Check whether specific ports are open on an IP or hostname—select a protocol or game instead of scanning all ports at once.
Built by Sebastian Rademacher
FAQ
Quick answers about port 21.
To open the control port with ufw, use sudo ufw allow 21/tcp. For passive mode, you also need the port range configured on your FTP server, for example sudo ufw allow 40000:40100/tcp. With firewalld, use sudo firewall-cmd --permanent --add-port=21/tcp followed by sudo firewall-cmd --reload.
Port 21 is the control channel for logins and commands. In active mode, the server uses port 20 for data transfers. Passive mode does not use port 20; the data channel uses a high-numbered port instead.
No, traditional FTP is unencrypted. Login credentials and files can be intercepted. SFTP over SSH on port 22 or FTPS with TLS are more secure.
FTP sends everything in plain text. FTPS is FTP with TLS encryption and still uses port 21 and a data channel. SFTP is a separate protocol based on SSH. It runs over port 22 and needs only one connection, making firewall configuration much simpler.
Any more questions?
Contact SupportWith a ZAP-Hosting VPS, you have root access, can set up services and firewall rules yourself, and can immediately see which ports are open.
No setup. No risk. Online in seconds.
Looking for more tools? View all network tools