One forgotten port range is the reason half of all FTP setups fail. Here is the complete, honest port map for your Synology file server — and what each number means for your firewall.
Every door on your file server has a number, and your firewall only respects numbers. This page lists the exact ports a Synology file server uses for SMB, FTP, FTPS, SFTP and TFTP, explains the one range everyone forgets — FTP's passive ports — and ends with the only forwarding rules you actually need.
SMB: TCP 445 (the old 137–139 NetBIOS ports belong to history; modern Windows sharing lives on 445). SFTP: TCP 22, shared with the SSH service. FTP: TCP 21 for commands, plus data connections explained below. FTPS: the same 21 with TLS in explicit mode. TFTP: UDP 69. DSM itself: 5000 (HTTP) and 5001 (HTTPS) — management, not file transfer.
FTP is the only protocol here that calls back. After logging in on port 21, the actual file moves over a separate connection, and in passive mode the server picks that port from a range. DSM's FTP settings show this range — the default begins at 55536. This is why FTP works perfectly on your LAN and fails mysteriously through a firewall: port 21 was allowed, the range was not. Whatever range DSM shows is the range your firewall and router must allow, exactly.
Open Control Panel → Security → Firewall, enable it, and build rules per service and per source: allow SMB from your LAN subnet only, allow SFTP from where it is genuinely needed, and end with a deny-all rule. The built-in application list lets you tick services by name instead of typing numbers — use it, and the port table above becomes a five-minute job.
If remote access is truly required, the forwarding shortlist is short: SFTP on 22 is the clean candidate — one port, encrypted, account-based. FTPS is acceptable with its passive range forwarded too. SMB stays home or travels inside a VPN. TFTP never leaves the LAN — it has no login at all. And the DSM admin ports: manage the NAS from the LAN or over VPN; forwarding 5000/5001 to the internet invites the world to try your admin password.
Work the chain in order: is the service enabled in File Services? Does it answer from another PC on the same LAN (that separates NAS problems from firewall problems)? Is the DSM firewall rule above the deny-all, and does it cover the source subnet? For FTP, is the passive range allowed as well as 21? Nine times out of ten the failure is one of these four — and it is the passive range more often than anyone admits.
445 never touches the internet, and FTP is never just port 21 — without its passive range it logs in beautifully and then transfers nothing.
SMB, FTP, SFTP and TFTP enabled step by step in DSM, with users, permissions and quotas.
▶️ Watch Full VideoAlmost always the passive data ports. The login uses port 21, but files move over a separate port from the passive range shown in DSM's FTP settings. Allow that whole range in the firewall and router, not just port 21.
Yes — the SSH service port in Terminal and SNMP can be changed, and the DSM firewall rule must match. It reduces background noise from scanners, but it is not real security by itself; strong passwords and limited accounts still do the real work.
No. Exposing SMB to the internet is one of the most abused openings in small networks. Use SFTP for direct file access from outside, or run a VPN and use your SMB shares inside it.