Port 20 / TCP
FTP-Data
Port 20 – FTP-Data Protocol Specification
Technical analysis, security advisories, vulnerability mitigation, and firewall syntax for TCP/UDP port 20 (FTP-Data).
Port Number
20
Transport Protocol
TCP
Port Range Type
Well-Known (0-1023)
Default Status
Restricted / LAN
Service Description & Architectural Context
File Transfer Protocol active data channel.
IANA / RFC Designation:
Port 20 is assigned to FTP-Data under the Internet Assigned Numbers Authority (IANA) service name registry. In enterprise infrastructure and homelab setups, services listening on this port must follow the principle of least privilege.
Security Analysis & Attack Surface Assessment
Unencrypted cleartext protocol. Use SFTP (port 22) or FTPS with TLS instead.
Hardening Recommendations:
- Do not expose port 20 to public WAN interfaces unless authenticated TLS or VPN wrapping is strictly enforced.
- Enforce rate-limiting using Fail2ban, CrowdSec, or cloud edge DDoS protection.
- Audit active listening sockets locally:
ss -tulpn | grep :20ornetstat -ano | findstr :20.
Firewall Rule Snippets for Port 20
UFW (Ubuntu / Debian Linux)
sudo ufw allow 20/tcp
iptables (Standard Linux Kernel)
sudo iptables -A INPUT -p tcp --dport 20 -j ACCEPT
Windows PowerShell (Defender Advanced Firewall)
New-NetFirewallRule -DisplayName "Allow Port 20" -Direction Inbound -LocalPort 20 -Protocol TCP -Action Allow