SFTP and FTPS Ports Explained: 22, 21, 990 and the Passive Range That Breaks Firewalls

Q: Is SFTP port 22 or 21?

SFTP is port 22. Port 21 belongs to FTP and to explicit FTPS, which are different protocols despite the similar name. If a client is configured for port 21 and the server offers only SFTP, the connection will fail at the protocol handshake rather than at login.

Q: What is the difference between port 21 and port 990?

Port 21 carries explicit FTPS, where the session begins unencrypted and the client issues an AUTH command to negotiate TLS. Port 990 carries implicit FTPS, where TLS is negotiated from the first byte and no AUTH command is sent. Explicit mode on port 21 is the preferred option; implicit mode exists for older clients that cannot do anything else.

Q: What ports need to be open for FTPS?

The control port (21 for explicit mode, 990 for implicit mode) and the whole passive data port range configured on the server. Both must be allowed inbound to the server. Opening only the control port produces the classic symptom of a client that logs in successfully and then hangs on the first directory listing.

Q: Why does FTP need a passive port range?

FTP and FTPS use one connection for commands and a second, separate connection for each transfer or listing. In passive mode the server picks a port for that data connection and tells the client which one to connect to. Constraining the choice to a defined range is what makes a firewall rule possible, because otherwise the port is unpredictable.

Q: Is port 22 TCP or UDP?

TCP. SSH, and therefore SFTP, is a stream protocol that depends on TCP's ordering and retransmission. A firewall rule that allows UDP 22 will not help an SFTP client connect.

SFTP uses TCP port 22, the SSH port, with one connection carrying everything. FTPS uses TCP port 21 for explicit mode or port 990 for implicit mode, and in both cases the control port is only half the answer, because a separate range of passive data ports has to be open as well. The second half is the part that produces support tickets.

Port numbers at a glance

Protocol	Port(s)	Transport	Notes
SFTP	22	TCP	Single connection over SSH; firewall-friendly
FTP	21 control, plus passive data range	TCP	Unencrypted; two-connection model
FTPS (explicit)	21 control, plus passive data range	TCP	Starts as FTP, upgrades to TLS via the AUTH command
FTPS (implicit)	990 control, plus passive data range	TCP	TLS from the first byte
HTTPS file transfer	443	TCP	Single connection; useful where FTPS ports are unavailable

Port 989 is registered with IANA as ftps-data, the implicit-mode counterpart to port 990. In practice implicit FTPS data connections are drawn from the server's passive port range in the same way explicit connections are, so a firewall rule for 989 alone will not make implicit transfers work. CompleteFTP exposes a configurable implicit FTPS control port and a passive port range, and has no separate implicit data-port setting.

Why SFTP needs only one port

SFTP is not FTP with encryption bolted on. It is a subsystem of SSH, which means an SFTP session is an SSH session with a file-transfer channel multiplexed inside it. Authentication, directory listings, file reads and file writes are all framed as messages inside that single TCP connection to port 22.

The firewall consequence is straightforward. One inbound rule permitting TCP 22 to the server is sufficient, and nothing about the session opens a second socket that the rule has not anticipated. CompleteFTP's documentation makes the same point when discussing firewall troubleshooting: SFTP has fewer problems with firewalls than FTPS because all commands and transfers go through a single port, and as long as connections to port 22 are permitted, SFTP should work.

Port 22 is TCP. SSH depends on ordered, retransmitted delivery, so a rule allowing UDP 22 accomplishes nothing.

There is a second-order effect worth planning for on busy servers. Because every SFTP session is one connection, a fleet of automated clients polling every minute produces a predictable connection count rather than a multiplying one, which makes capacity and connection-limit planning easier than the equivalent FTPS deployment. Automated fleets are covered in more depth in SFTP automation.

Why FTP and FTPS need a passive port range

FTP was designed with two channels. The control channel carries commands and replies, and a separate data connection is created for each directory listing and each file transfer. That design predates NAT and stateful firewalls by some margin, and it is the source of nearly every FTPS connectivity problem.

In the original active mode the server opened the data connection back to the client, connecting outward to a port the client had nominated with the PORT command. Client-side firewalls and NAT devices made inbound connections to clients impractical, so passive mode was introduced. In passive mode the client initiates both connections. The client sends PASV, the server picks a port, listens on it, and replies with an address and port for the client to connect to.

That reply is the crux of it. The port the server nominates is chosen at the moment of the request, so unless the server is told which ports it may choose from, the number is effectively unpredictable and no static firewall rule can cover it.

Plain FTP survives this because the commands travel in clear text and firewalls with FTP inspection can read the PASV reply and open the nominated port on the fly. FTPS removes that possibility because the control channel is protected with TLS, which leaves the firewall reading ciphertext and unable to tell which port it would need to open. Configuring a bounded passive range on the server and matching it with a static firewall rule is the only thing that replaces the dynamic inspection FTPS took away.

The other half of the PASV reply causes its own trouble. Over IPv4 the server also tells the client which IP address to connect to, and a server behind a NAT device will report its internal address unless it has been configured with an external one. Clients then try to open a data connection to an address that means nothing on their side of the network. Over IPv6 this does not arise, because the client is required to reuse the address of the control connection.

What to open on the firewall

For SFTP:

Inbound TCP 22 (or your chosen SFTP port) to the server.

For explicit FTPS:

Inbound TCP 21 to the server, for the control channel.
Inbound TCP for the entire passive port range to the server.

For implicit FTPS:

Inbound TCP 990 to the server, for the control channel.
Inbound TCP for the entire passive port range to the server.

Three details decide whether this works on the first attempt.

The passive range configured on the server and the range permitted by the firewall must be identical. A range narrower on the firewall than on the server produces transfers that succeed intermittently, depending on which port the server happened to choose, which is a far more confusing failure than a clean refusal.

If the server sits behind NAT, the external IP address setting has to be paired with the port range, not treated as an alternative to it. Both are needed. CompleteFTP applies the external address to FTP and FTPS by default and can be set to apply it to FTPS only, which is the workaround for routers that expect to inspect and rewrite the local address themselves and drop the connection when they cannot find it.

Endpoint protection and application-layer inspection count as firewalls for this purpose. A rule added at the perimeter does not help if a host-based product on the server is closing the data connections.

In CompleteFTP the passive range is set with the Minimum port number and Maximum port number settings in the Passive (PASV) Transfer Settings group. The recommendation in the documentation is a range of about 100 ports somewhere between 1024 and 65535, for example 15000 to 15100. If the values are left unset, defaults apply, which means the operating system assigns the port and no firewall rule can be written for it. The step-by-step procedure, with screenshots, is in how to set a PASV port range.

The failures these cause in production

The symptom described in CompleteFTP's own firewall documentation is specific enough to be diagnostic: using FTPS, clients can connect but transfers and directory listings hang and eventually time out. Login works because the control channel on port 21 or 990 is open. The listing hangs because the data connection has nowhere to land.

Port and firewall trouble is a steady presence in our support archive rather than an occasional one. Roughly one organization in ten has raised it: 165 of the 1,621 organizations profiled, and 695 of the 8,663 tickets in the archive, two counts that arrive at about the same proportion from different directions. Both are floors rather than ceilings, because a firewall that was configured correctly the first time never produces a ticket.

The first pattern is a passive range that the server and the firewall disagree about, or that the server is not actually honouring because the setting was applied somewhere other than the site in use.

"I've set up an FTP site as attached using a port range. When connecting Passive Mode appears to be requesting ports outside of that range."

a UK distribution organization (EnterpriseDT support archive)

The second is a rule that exists at the perimeter while something closer to the server is still blocking, which usually surfaces as transfers that work from inside the network and fail from outside.

"When we are installing [endpoint security and firewall software] users are unable to connect via SFTP to the server."

a Middle East banking organization (EnterpriseDT support archive)

The third is the external IP address, either unset on a NAT'd server, set to an address that has stopped being correct, or changed during troubleshooting without the passive range being revisited alongside it.

"To rule out the router and simplify the connection, I have configured the FTP Server's Host A record in our DNS to point directly to server's internal IP address [internal IP]. In CompleteFTP, I removed the External IP Address and entered the port range you suggested; 10,000 - 11,000."

a US local government organization (EnterpriseDT support archive)

Deployments that run SFTP alongside FTPS tend to report the same shape of incident: the SFTP users are unaffected while the FTPS users cannot list a directory. The protocol comparison in FTPS vs SFTP goes into why that difference is structural rather than incidental.

Frequently asked questions

What port does SFTP use?

SFTP uses TCP port 22, the same port as SSH, because SFTP runs as a subsystem of SSH. Commands, listings and file data share that one connection, so port 22 is the only port a firewall has to allow.

Is SFTP port 22 or 21?

Port 22. Port 21 belongs to FTP and to explicit FTPS, which are unrelated protocols despite the similar names. A client pointed at port 21 on an SFTP-only server fails at the protocol handshake rather than at login.

What is the difference between port 21 and port 990?

Port 21 carries explicit FTPS, where the session starts unencrypted and the client issues an AUTH command to negotiate TLS. Port 990 carries implicit FTPS, where TLS begins with the first byte and no AUTH command is sent. Explicit mode is preferred, and implicit mode is best left disabled unless a client requires it.

What ports need to be open for FTPS?

The control port (21 for explicit, 990 for implicit) and the whole passive data port range, both inbound to the server. Opening only the control port gives you a client that logs in and then hangs on its first listing.

Why does FTP need a passive port range?

Because each transfer and listing uses a second connection on a port the server chooses at request time. Constraining that choice to a defined range is what makes a static firewall rule possible.

Is port 22 TCP or UDP?

TCP. A rule permitting UDP 22 will not help an SFTP client connect.

Configuring this on your own server

CompleteFTP groups protocols and port numbers into sites. The default site carries FTP and FTPS on port 21 and SSH, SCP and SFTP on port 22, with HTTP on 80 and HTTPS on 443 available as options, and every one of those port numbers can be changed. Implicit FTPS has its own enable switch and its own configurable port. The passive range and the external IP address are settings in the same panel rather than lines in a text file, which shortens the loop between changing a value and testing whether the firewall agrees with it.

The 30-day trial is a full server, so a passive range and a firewall rule can be tested against a real client before the change reaches production. For background on the server side generally, see the SFTP server guide.