Network ports · 20
20 — FTP data
Port 20 carries FTP data in active mode, from server to client.
Key facts
| Port | 20 |
|---|---|
| Transport | TCP |
| Service | FTP data transfer |
| Direction | Server to client in active mode |
| Encryption | None in plain FTP |
| Range | Well-known (0–1023) |
Active mode reverses the connection
FTP uses two connections: a control channel on port 21 and a data channel that carries files and directory listings. In active mode the server opens the data connection back to a port the client announced, and the source port is 20. That inbound connection is why active FTP struggles behind NAT and firewalls.
Passive mode solves the problem by having the server listen on a high port and tell the client where to connect. Modern clients default to passive, so traffic on port 20 is less common than it once was.
Why plain FTP is obsolete
FTP sends credentials and file contents in clear text. FTPS wraps the same protocol in TLS, while SFTP is a different protocol carried over SSH on port 22. For new deployments, SFTP or HTTPS-based file transfer is the safer default.
If you must run FTP, restrict the passive port range, enable TLS, and allow only the networks that need it. The data port is not a fixed single port in passive mode, which is a common firewall surprise.
Frequently asked questions
Is port 20 always used for FTP data?
Only in active mode. In passive mode the server chooses a high port and announces it on the control channel.
Does opening port 21 allow file transfer?
No. Port 21 is control only; the data connection needs its own ports open as well.