Why does port 20 fail through NAT routers and home firewalls?

In Active FTP, the server attempts to open an inbound TCP connection back to the client on port 20. Because consumer NAT routers drop unsolicited incoming connections by default, the connection is blocked unless the client switches to Passive FTP (PASV).

Is port 20 secure to expose over the internet?

No. Traffic over Port 20 is unencrypted plaintext. Anyone capable of capturing network packets along the routing path can reconstruct and read the transferred files. Use SFTP (port 22) or FTPS instead.

How do I test if port 20 is open?

You can test connectivity to port 20 using LotsofNetwork's Open Port Checker or by running 'nc -zv 20' from your local terminal.

Home/Open Port Checker/Port 20

Port 21

Well-Known Port Reference

Port 20: FTP Data Transfer (TCP)

File Transfer Protocol data channel used in Active FTP mode to transmit directory listings and file payloads.

Port Number

Transport

TCP

Security Risk

High

Standard / RFC

RFC 959

Test Port 20 Reachability Live

Verify whether Port 20 is open, closed, or filtered on your server or public IP address.

Loading port checker...

Service Architecture & Function

Port 20 is historically paired with Port 21 in classic Active FTP setups. When a client requests a file download or directory list over the control connection (port 21), the FTP server initiates a reverse TCP connection from port 20 back to an ephemeral port on the client. Modern firewalls and NAT routers often break this flow, leading to widespread adoption of Passive FTP (PASV) where data ports are negotiated dynamically.

Security Profile & Hardening

Standard FTP transmits all payload data in unencrypted plaintext. Attackers with network visibility can sniff confidential files in transit. Modern environments should disable Active FTP in favor of SFTP (SSH Port 22) or FTPS (FTP over TLS).

Example Firewall Commands:

# UFW (Ubuntu/Debian)

sudo ufw allow 20/tcp

# iptables (Direct Kernel)

iptables -A INPUT -p tcp --dport 20 -j ACCEPT

Frequently Asked Questions

Technical answers and configuration advice for Port 20.

Port 20 is used as the data transfer stream in Active FTP mode. While Port 21 handles authentication and command signaling, actual file contents and directory listings travel across Port 20.