Common ports reference
What runs on each port, whether it is encrypted, and which ones should never face the internet.
Try 443, ssh, database, or mail.
Port
| Port | Protocol | Service | Exposure | Notes |
|---|---|---|---|---|
| 20 | tcp | FTP data | Never expose | Unencrypted. Use SFTP instead. |
| 21 | tcp | FTP control | Never expose | Sends credentials in clear text. |
| 22 | tcp | SSH / SFTP | Expose with care | Encrypted. Key-only authentication, and restrict the source addresses. |
| 23 | tcp | Telnet | Never expose | Everything in clear text, including the password. Obsolete. |
| 25 | tcp | SMTP | Expose with care | Server-to-server mail. Most home connections block it outbound. |
| 53 | tcp/udp | DNS | Expose with care | An open recursive resolver will be abused for amplification attacks. |
| 67 | udp | DHCP server | Never expose | Local network only. |
| 68 | udp | DHCP client | Never expose | Local network only. |
| 69 | udp | TFTP | Never expose | No authentication at all. |
| 80 | tcp | HTTP | Fine to expose | Unencrypted web. Normally redirected straight to 443. |
| 110 | tcp | POP3 | Never expose | Unencrypted mail retrieval. Use 995. |
| 111 | tcp/udp | rpcbind / portmapper | Never expose | Used for NFS. A well-known amplification vector. |
| 123 | udp | NTP | Expose with care | Time sync. Open servers get abused for amplification. |
| 135 | tcp | Windows RPC | Never expose | Internal Windows networking. |
| 137 | udp | NetBIOS name | Never expose | Legacy Windows networking. |
| 139 | tcp | NetBIOS session | Never expose | Legacy Windows file sharing. |
| 143 | tcp | IMAP | Never expose | Unencrypted mail access. Use 993. |
| 161 | udp | SNMP | Never expose | Often left on the default community string "public". |
| 389 | tcp | LDAP | Never expose | Directory service, unencrypted. Use 636. |
| 443 | tcp | HTTPS | Fine to expose | Encrypted web. The one port nearly every site needs. |
| 445 | tcp | SMB | Never expose | Windows file sharing. The route WannaCry took. Never expose this. |
| 465 | tcp | SMTPS | Fine to expose | Mail submission over TLS. |
| 500 | udp | IKE / IPsec | Expose with care | VPN key exchange. |
| 514 | udp | syslog | Never expose | Unauthenticated log collection. |
| 587 | tcp | SMTP submission | Fine to expose | Mail submission with STARTTLS. The usual port for sending. |
| 631 | tcp | IPP / CUPS | Never expose | Printing. Local network only. |
| 636 | tcp | LDAPS | Expose with care | Directory service over TLS. |
| 993 | tcp | IMAPS | Fine to expose | Mail access over TLS. |
| 995 | tcp | POP3S | Fine to expose | Mail retrieval over TLS. |
| 1080 | tcp | SOCKS proxy | Never expose | An open proxy will be found and abused quickly. |
| 1194 | udp | OpenVPN | Expose with care | VPN. Designed to face the internet. |
| 1433 | tcp | Microsoft SQL Server | Never expose | Database. Private network or VPN only. |
| 1521 | tcp | Oracle database | Never expose | Database. Private network or VPN only. |
| 1883 | tcp | MQTT | Never expose | IoT messaging, unencrypted. Use 8883. |
| 2049 | tcp/udp | NFS | Never expose | File sharing with weak authentication. |
| 2375 | tcp | Docker API | Never expose | Unauthenticated root on the host. Exposing this gives the machine away. |
| 2376 | tcp | Docker API (TLS) | Never expose | Still full control of the host. Keep it private. |
| 3000 | tcp | Development server | Never expose | Node, Rails and Grafana default. Not meant for production exposure. |
| 3306 | tcp | MySQL / MariaDB | Never expose | Database. One of the most commonly exposed by mistake. |
| 3389 | tcp | RDP | Never expose | Windows remote desktop. Heavily attacked; put it behind a VPN. |
| 4444 | tcp | Metasploit default | Never expose | Common reverse-shell port. Seeing it listening is a bad sign. |
| 5432 | tcp | PostgreSQL | Never expose | Database. Private network or VPN only. |
| 5601 | tcp | Kibana | Never expose | Dashboards over your logs. Often left without authentication. |
| 5672 | tcp | AMQP / RabbitMQ | Never expose | Message broker. Private network only. |
| 5900 | tcp | VNC | Never expose | Remote desktop, often with weak or no password. |
| 6379 | tcp | Redis | Never expose | No authentication by default. Exposing it is a standard compromise route. |
| 8000 | tcp | Development server | Expose with care | Common alternative HTTP port. |
| 8080 | tcp | HTTP alternate | Expose with care | Proxies and app servers. Normally behind a reverse proxy. |
| 8443 | tcp | HTTPS alternate | Expose with care | Admin interfaces and app servers over TLS. |
| 8883 | tcp | MQTT over TLS | Expose with care | Encrypted IoT messaging. |
| 9000 | tcp | PHP-FPM / Portainer | Never expose | PHP-FPM must never be exposed; it executes what it is sent. |
| 9090 | tcp | Prometheus | Never expose | Metrics, usually unauthenticated. |
| 9200 | tcp | Elasticsearch | Never expose | Open by default in older versions. A frequent source of data leaks. |
| 11211 | tcp/udp | Memcached | Never expose | No authentication, and a severe UDP amplification vector. |
| 27017 | tcp | MongoDB | Never expose | Historically bound to all interfaces with no password. Keep it private. |
| 51820 | udp | WireGuard | Expose with care | VPN. Silent to unauthenticated probes by design. |
Exposure guidance
- Fine to expose
- Designed to face the internet, and encrypted.
- Expose with care
- Sometimes needs to face the internet, but wants authentication, patching and rate limiting.
- Never expose
- Should only ever be reachable over a private network or a VPN. These are the ports that show up in breach reports.
Scanning your own machine
We do not provide a port scanner. A browser cannot open raw sockets, so any web-based scanner runs from its own servers, which means someone else’s machine sends unsolicited connections to your address on your behalf. To check your own machine, run a scanner locally where the results are accurate and the traffic is yours.
From another machine on your network:
nmap -Pn -sV 192.168.1.10
To list what is listening on the machine itself:
ss -tulpn
よくある質問
Why is there no port scanner here?
Because a browser has no way to open raw sockets, so every web-based port scanner actually scans from its own servers. That means a third party sends unsolicited connections to a host on your say-so. Done to your own machine that is merely inaccurate, because it tests their path rather than yours; done to anyone else’s it is unauthorised scanning, which breaches most hosting providers’ terms and is a criminal matter in several countries.
Running nmap yourself takes a minute, gives better results, and the traffic is honestly yours.
What is the difference between TCP and UDP?
TCP sets up a connection and guarantees that everything arrives, in order, resending what goes missing. UDP just sends, with no connection and no guarantee. TCP suits anything where missing data breaks the result — web pages, files, mail. UDP suits anything where late data is useless anyway, such as voice, video and games.
Which ports should be open on my server?
As few as possible. For a typical web server that is 80 and 443, plus SSH on 22 restricted to addresses you trust. Everything else — databases, caches, admin panels, container runtimes — belongs on a private network or behind a VPN. The ports marked “never expose” here are the ones that turn up again and again in breach reports, because they were left reachable by accident.
Does changing SSH off port 22 make it safer?
Only slightly, and not in the way people hope. It cuts the noise in your logs from untargeted scanning, but anyone actually looking will find it in seconds. Key-only authentication, a firewall and fail2ban do the real work. Moving the port is tidying, not security.