FTP, SFTP and FTPS port numbers, and what to open in the firewall

File-transfer connection failures are very often port problems, and the three protocols use ports differently. This page lists the standard numbers, explains the data connections that FTP and FTPS open on top of them, and says what a firewall has to allow in each case.

The standard ports

Servers can be configured on other ports; the client simply has to be told. FTPShell Client pre-fills 21, 22 or 990 when you open an FTP, SFTP or FTPS session and accepts any port you type.

Why FTP needs more than port 21

FTP uses the control connection on port 21 only for commands. Every directory listing and every file transfer opens a second connection. In active mode the client picks a port, tells the server with PORT, and the server connects back to it from port 20; that fails whenever the client is behind NAT or a firewall that blocks inbound connections, which is nearly always today. In passive mode the client sends PASV, the server replies with an address and port, and the client connects out to it; that works through the client's firewall but requires the server's passive port range to be reachable. Most clients, FTPShell included, default to passive and fall back to active if the listing fails.

What to open in a firewall

On the client side, outbound TCP to the server's control port (21, 990 or 22) and, for FTP and FTPS, outbound TCP to the server's passive range. Stateful firewalls that inspect FTP can open passive data ports automatically for plain FTP, but not for FTPS, because the PASV reply is encrypted; that is the most common reason an FTPS listing hangs after a successful login. On the server side, inbound TCP on the control port and on the whole passive range, and a server configured to announce its public address in PASV replies when it sits behind NAT. FTPShell corrects FTPS passive replies that carry a private NAT address, but it cannot open a port the server never exposes.

SFTP: one port, no exceptions

SFTP needs only outbound TCP 22 from the client to the server. Login, listings, uploads and downloads all travel inside that one SSH connection, which is why SFTP connects in places where FTP and FTPS have to be debugged. If a host offers both, that alone is a reason to pick SFTP; see SFTP vs FTPS vs FTP.

Questions people ask

What port does FTP use?

Port 21 for the control connection. Data travels on port 20 (active mode) or on a server-chosen passive port.

What port does SFTP use?

Port 22, the SSH port, for everything.

What port does FTPS use?

Port 21 for explicit FTPS (AUTH TLS) and port 990 for implicit FTPS, plus the server's passive data ports for listings and transfers.

What is port 20 for?

Active-mode FTP data connections: the server connects from its port 20 to the port the client announced. Passive mode does not use it.

Does an FTP client need an inbound port open?

Only in active mode. In passive mode, the default in FTPShell Client, the client makes all connections outbound and nothing needs to be opened on the client side.

Which port should I use for secure FTP?

It depends on which protocol the server runs: 22 for SFTP, 21 or 990 for FTPS. The server's documentation or welcome e-mail says which; an FTPShell session type matches each one.

What are the default FTP ports, the passive FTP ports and the PASV port range?

The default FTP port is 21 for the control connection and 20 for active-mode data. The passive FTP ports are whatever the server announces in its PASV reply: a range the server administrator configures, typically a block of a thousand or so ports above 1024, which the server's firewall must leave open. A client has no say in the range; it connects to the port it is given.

Does SFTP use TCP or UDP, and does FTP use UDP?

Both use TCP. SFTP runs inside SSH on TCP port 22; FTP uses TCP for its control and data connections. Neither uses UDP; the protocol that does is TFTP, Trivial File Transfer Protocol, a different and much simpler protocol used mostly for booting network devices.