NetSecWallFree trialDownload
Ports 21 and 20 · TCP

Ports 21 and 20: FTP

File Transfer Protocol. Port 21 carries the commands and, in the old "active" mode, port 20 carries the files. FTP sends the user name and password in plain text.

Protocol
TCP
On Windows
Not part of Windows; installed software uses it
Risk if open to the internet
High

Seeing it on your PC

An outgoing connection to port 21 is an FTP client such as FileZilla or a backup tool. A listener on 21 means an FTP server is installed, for example the FTP role of IIS or FileZilla Server.

Should you block it?

If you did not set up an FTP server, nothing should listen here; uninstall or stop the server rather than relying on a firewall rule. Prefer SFTP (port 22) or FTPS when you need to move files.

Check it on your PC

Run this in PowerShell to see what is using port 21 right now, and which program owns it:

Get-NetTCPConnection -LocalPort 21 -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,@{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}

No output means nothing is using the port at the moment. For every connection at once, paste netstat -ano into the netstat explainer.

Block it in Windows Firewall

In PowerShell run as administrator, this stops other computers from connecting to this port on your PC. It does not stop your own programs connecting out.

New-NetFirewallRule -DisplayName "Block inbound TCP 21,20" -Direction Inbound -Protocol TCP -LocalPort 21,20 -Action Block

Undo it with Remove-NetFirewallRule -DisplayName "Block inbound …", using the same name. If you depend on the service on your local network, this rule stops that too.