Remote access 11
| 22 | TCP | SSH / SFTP Secure shell for remote administration, SFTP and SCP file transfer, Git over SSH. | Expose with care |
| 23 | TCP | Telnet Unencrypted remote console, still found on routers, switches and IoT devices. | Do not expose |
| 3283 | TCP/UDP | Apple Remote Desktop Apple Remote Desktop reporting; abused for DDoS amplification. | Do not expose |
| 3389 | TCP/UDP | RDP Windows Remote Desktop. One of the most brute-forced ports on the internet. | Do not expose |
| 5555 | TCP | Android ADB Android Debug Bridge over network: full control of the device. | Do not expose |
| 5900 | TCP | VNC VNC remote desktop, often with weak or no password. | Do not expose |
| 5938 | TCP/UDP | TeamViewer TeamViewer connections (outbound from the client). | Expose with care |
| 5985 | TCP | WinRM HTTP Windows Remote Management / PowerShell remoting over HTTP. | Do not expose |
| 5986 | TCP | WinRM HTTPS WinRM over HTTPS. | Do not expose |
| 6000 | TCP | X11 X Window System display server. | Do not expose |
| 8291 | TCP | MikroTik WinBox MikroTik WinBox management. Exploited at scale (CVE-2018-14847); restrict to the LAN or VPN. | Do not expose |
Databases 12
| 1433 | TCP | Microsoft SQL Server MS SQL Server database engine. | Do not expose |
| 1434 | UDP | MS SQL Browser SQL Server Browser service (instance discovery). | Do not expose |
| 1521 | TCP | Oracle DB Oracle database listener. | Do not expose |
| 3306 | TCP | MySQL / MariaDB MySQL and MariaDB databases. | Do not expose |
| 5432 | TCP | PostgreSQL PostgreSQL database. | Do not expose |
| 6379 | TCP | Redis Redis in-memory database; unauthenticated Redis is a classic way to get hacked. | Do not expose |
| 8086 | TCP | InfluxDB InfluxDB time-series database HTTP API. | Do not expose |
| 9042 | TCP | Cassandra Apache Cassandra CQL. | Do not expose |
| 9200 | TCP | Elasticsearch Elasticsearch REST API; exposed clusters leak billions of records. | Do not expose |
| 9300 | TCP | Elasticsearch transport Elasticsearch node-to-node transport. | Do not expose |
| 11211 | TCP/UDP | Memcached Memcached cache; UDP memcached gave record-breaking DDoS amplification. | Do not expose |
| 27017 | TCP | MongoDB MongoDB database; open instances are wiped and ransomed within hours. | Do not expose |
VoIP and telephony 15
| 1720 | TCP | H.323 H.323 call signalling of older video conferencing and VoIP systems. | Do not expose |
| 2000 | TCP | Cisco SCCP (Skinny) Cisco Skinny call control between IP phones and CUCM. MikroTik also uses 2000 for its bandwidth test. | Do not expose |
| 2427 | UDP | MGCP gateway Media Gateway Control Protocol, gateway side. | Do not expose |
| 2727 | UDP | MGCP call agent MGCP call agent (softswitch) side. | Do not expose |
| 2944 | TCP/UDP | H.248 / Megaco H.248 (Megaco) control of media gateways by softswitches. | Do not expose |
| 3478 | TCP/UDP | STUN / TURN NAT traversal for WebRTC, video calls and VoIP (STUN, TURN). | Normal to expose |
| 4569 | UDP | IAX2 Inter-Asterisk eXchange: signalling and media in one UDP stream. | Expose with care |
| 5004 | UDP | RTP Default RTP media port for many VoIP and streaming systems. | Normal to expose |
| 5060 | TCP/UDP | SIP SIP signalling for IP telephony: registration of phones and trunks, call setup. Constantly scanned by toll-fraud bots. | Expose with care |
| 5061 | TCP | SIP over TLS Encrypted SIP (SIPS), used with SRTP for secure calls. | Expose with care |
| 5080 | TCP/UDP | FreeSWITCH external SIP FreeSWITCH "external" SIP profile (5060 is the internal one by default). | Expose with care |
| 8021 | TCP | FreeSWITCH Event Socket FreeSWITCH Event Socket: full control of the switch, default password ClueCon. | Do not expose |
| 8088 | TCP | Asterisk HTTP / ARI Asterisk built-in HTTP server: ARI, AMI over HTTP, WebSocket for WebRTC. | Do not expose |
| 8089 | TCP | Asterisk HTTPS / WSS Asterisk HTTPS and secure WebSocket for WebRTC phones. | Expose with care |
| 19302 | UDP | Google STUN Google public STUN servers used by WebRTC. | Normal to expose |
File sharing 14
| 20 | TCP | FTP data Data channel of classic FTP (active mode). | Do not expose |
| 21 | TCP | FTP FTP control connection. Logins and files travel unencrypted. | Do not expose |
| 69 | UDP | TFTP Trivial FTP without authentication. Used to provision IP phones and network boot (PXE). | Do not expose |
| 111 | TCP/UDP | rpcbind / portmapper Sun RPC port mapper used by NFS. Often abused for DDoS amplification. | Do not expose |
| 135 | TCP | MS RPC Windows RPC endpoint mapper (DCOM, WMI, Active Directory). | Do not expose |
| 137 | UDP | NetBIOS Name NetBIOS name service of old Windows networking. | Do not expose |
| 138 | UDP | NetBIOS Datagram NetBIOS datagram service. | Do not expose |
| 139 | TCP | NetBIOS Session SMB over NetBIOS, Windows file sharing in old networks. | Do not expose |
| 445 | TCP | SMB Windows file sharing. The vector of WannaCry and many ransomware outbreaks; ISPs often block it. | Do not expose |
| 548 | TCP | AFP Apple Filing Protocol, file sharing on old macOS and NAS. | Do not expose |
| 873 | TCP | rsync rsync daemon for file synchronisation and backups. | Do not expose |
| 990 | TCP | FTPS FTP over implicit TLS. | Expose with care |
| 2049 | TCP/UDP | NFS Network File System shares. | Do not expose |
| 3260 | TCP | iSCSI iSCSI block storage. | Do not expose |
Management and DevOps 22
| 161 | UDP | SNMP Monitoring and management of network devices. Community strings like "public" leak the whole config. | Do not expose |
| 162 | UDP | SNMP trap SNMP traps: devices send alerts to the monitoring server. | Expose with care |
| 427 | UDP | SLP Service Location Protocol, found on VMware ESXi and printers; exploited by ransomware and DDoS. | Do not expose |
| 514 | UDP | Syslog Classic syslog log collection. | Expose with care |
| 623 | UDP | IPMI Server out-of-band management (iDRAC, iLO, IPMI). Known authentication bypasses. | Do not expose |
| 902 | TCP | VMware ESXi VMware ESXi host agent and remote console. | Do not expose |
| 2375 | TCP | Docker API Docker daemon API without TLS: anyone who reaches it controls the host. | Do not expose |
| 2376 | TCP | Docker API TLS Docker daemon API with TLS client certificates. | Do not expose |
| 2379 | TCP | etcd etcd key-value store, the brain of Kubernetes clusters. | Do not expose |
| 4369 | TCP | Erlang EPMD Erlang port mapper (RabbitMQ, CouchDB, ejabberd clusters). | Do not expose |
| 6443 | TCP | Kubernetes API Kubernetes API server. | Do not expose |
| 6514 | TCP | Syslog over TLS Encrypted syslog. | Expose with care |
| 7547 | TCP | TR-069 (CWMP) Remote management of home routers by the ISP. Mass-exploited (Mirai). | Do not expose |
| 8200 | TCP | HashiCorp Vault Vault secrets manager API. | Do not expose |
| 8500 | TCP | Consul HashiCorp Consul HTTP API. | Do not expose |
| 8728 | TCP | MikroTik API RouterOS API (plain). | Do not expose |
| 8729 | TCP | MikroTik API-SSL RouterOS API over TLS. | Do not expose |
| 9090 | TCP | Prometheus / Cockpit Prometheus server and Cockpit web console. | Do not expose |
| 9100 | TCP | Node exporter / JetDirect Prometheus node exporter, and raw printing on HP JetDirect printers. | Do not expose |
| 10000 | TCP | Webmin Webmin server administration panel. | Do not expose |
| 10050 | TCP | Zabbix agent Zabbix agent (passive checks). | Expose with care |
| 10051 | TCP | Zabbix server Zabbix server / proxy trapper. | Expose with care |
Web and panels 16
| 80 | TCP | HTTP Unencrypted web. Today mostly redirects to HTTPS and serves Let's Encrypt validation. | Normal to expose |
| 443 | TCP/UDP | HTTPS Encrypted web (TLS). UDP 443 carries HTTP/3 (QUIC). Also used by many VPNs to get through firewalls. | Normal to expose |
| 2082 | TCP | cPanel cPanel hosting control panel (HTTP). | Expose with care |
| 2083 | TCP | cPanel SSL cPanel over HTTPS. | Expose with care |
| 2087 | TCP | WHM SSL WebHost Manager for cPanel servers. | Expose with care |
| 2222 | TCP | DirectAdmin / alt SSH DirectAdmin control panel, also a common alternative SSH port. | Expose with care |
| 3000 | TCP | Grafana / dev servers Default for Grafana and many development web servers (Node.js, Rails). | Expose with care |
| 5000 | TCP | UPnP / Synology DSM / Flask Synology DSM web UI, UPnP control, Flask and Docker registry default. | Expose with care |
| 5001 | TCP | Synology DSM HTTPS Synology DSM over HTTPS. | Expose with care |
| 5601 | TCP | Kibana Kibana dashboards for Elasticsearch. | Do not expose |
| 8000 | TCP | HTTP alt / Hikvision Alternative HTTP port; Hikvision cameras use 8000 for their SDK. | Expose with care |
| 8009 | TCP | AJP (Tomcat) Apache JServ Protocol between web server and Tomcat (Ghostcat vulnerability). | Do not expose |
| 8080 | TCP | HTTP alt / proxy Common alternative HTTP port: Tomcat, Jenkins, proxies, admin panels. | Expose with care |
| 8443 | TCP | HTTPS alt Alternative HTTPS: admin panels, UniFi, Plesk, proxies. | Expose with care |
| 9000 | TCP | PHP-FPM / Portainer / MinIO PHP-FPM FastCGI, Portainer, MinIO, SonarQube defaults. PHP-FPM exposed means code execution. | Do not expose |
| 15672 | TCP | RabbitMQ management RabbitMQ web management UI (default guest/guest). | Do not expose |
Email 7
| 25 | TCP | SMTP Mail transfer between servers. Most ISPs and clouds block outbound 25 to fight spam. | Expose with care |
| 110 | TCP | POP3 Mail download without encryption. Prefer POP3S on 995. | Expose with care |
| 143 | TCP | IMAP Mail access without encryption (or with STARTTLS). Prefer IMAPS on 993. | Expose with care |
| 465 | TCP | SMTPS Mail submission over implicit TLS for mail clients. | Normal to expose |
| 587 | TCP | SMTP submission Mail submission from clients with STARTTLS and authentication. | Normal to expose |
| 993 | TCP | IMAPS IMAP over TLS, the normal way mail clients read mail. | Normal to expose |
| 995 | TCP | POP3S POP3 over TLS. | Normal to expose |
VPN 6
| 500 | UDP | IKE (IPsec) IPsec key exchange (IKEv1/IKEv2) for site-to-site and remote access VPNs. | Normal to expose |
| 1194 | UDP | OpenVPN Default OpenVPN port (UDP, sometimes TCP). | Normal to expose |
| 1701 | UDP | L2TP L2TP tunnels, normally inside IPsec (L2TP/IPsec VPN). | Expose with care |
| 1723 | TCP | PPTP PPTP VPN. Its MS-CHAPv2 encryption is broken; replace with WireGuard or IPsec. | Do not expose |
| 4500 | UDP | IPsec NAT-T IPsec traffic encapsulated in UDP when there is NAT on the path. | Normal to expose |
| 51820 | UDP | WireGuard Default WireGuard VPN port. Silent to scanners without a valid key. | Normal to expose |
Network infrastructure 20
| 43 | TCP | WHOIS WHOIS queries to registries about domains and IP addresses. | Normal to expose |
| 53 | TCP/UDP | DNS Domain name system. UDP for normal queries, TCP for large answers and zone transfers. | Expose with care |
| 67 | UDP | DHCP server DHCP server side: hands out IP addresses in a local network. | Do not expose |
| 68 | UDP | DHCP client DHCP client side: where devices receive their address. | Normal to expose |
| 88 | TCP/UDP | Kerberos Kerberos authentication, the core of Active Directory logins. | Do not expose |
| 123 | UDP | NTP Network time. Public NTP servers listen here; open misconfigured servers are used for DDoS amplification. | Expose with care |
| 179 | TCP | BGP Border Gateway Protocol sessions between routers of different networks. | Expose with care |
| 389 | TCP/UDP | LDAP Directory access (Active Directory, OpenLDAP). UDP 389 (CLDAP) is a DDoS amplifier. | Do not expose |
| 520 | UDP | RIP Routing Information Protocol. | Expose with care |
| 546 | UDP | DHCPv6 client DHCPv6 client side. | Normal to expose |
| 547 | UDP | DHCPv6 server DHCPv6 server side. | Do not expose |
| 636 | TCP | LDAPS LDAP over TLS. | Do not expose |
| 646 | TCP/UDP | LDP MPLS Label Distribution Protocol. | Expose with care |
| 853 | TCP/UDP | DNS over TLS / QUIC Encrypted DNS: DoT over TCP, DoQ over UDP. | Normal to expose |
| 1812 | UDP | RADIUS auth RADIUS authentication for Wi-Fi, VPN and PPPoE subscribers. | Expose with care |
| 1813 | UDP | RADIUS accounting RADIUS accounting (session start/stop, traffic). | Expose with care |
| 4789 | UDP | VXLAN VXLAN overlay networks (data centres, Kubernetes CNIs). | Do not expose |
| 5353 | UDP | mDNS Multicast DNS (Bonjour, Avahi) for local discovery; must not answer the internet. | Do not expose |
| 5355 | UDP | LLMNR Windows link-local name resolution, abused for credential theft in LANs. | Do not expose |
| 33434 | UDP | Traceroute Start of the UDP port range used by Unix traceroute. | Normal to expose |
IoT and industrial 8
| 102 | TCP | Siemens S7 (ISO-TSAP) Siemens S7 PLC communication in industrial networks. | Do not expose |
| 502 | TCP | Modbus TCP Industrial Modbus without any authentication. | Do not expose |
| 1883 | TCP | MQTT MQTT broker for IoT devices, unencrypted. | Do not expose |
| 4840 | TCP | OPC UA OPC UA industrial automation protocol. | Do not expose |
| 5683 | UDP | CoAP Constrained Application Protocol for IoT; exposed CoAP amplifies DDoS. | Do not expose |
| 8883 | TCP | MQTT over TLS MQTT with TLS. | Expose with care |
| 44818 | TCP/UDP | EtherNet/IP EtherNet/IP (CIP) industrial protocol, Rockwell/Allen-Bradley. | Do not expose |
| 47808 | UDP | BACnet BACnet building automation (HVAC, lighting). | Do not expose |
Messaging and queues 8
| 119 | TCP | NNTP Usenet news. | Normal to expose |
| 5222 | TCP | XMPP client XMPP (Jabber) client connections. | Normal to expose |
| 5223 | TCP | Apple Push Apple Push Notification service connections from devices. | Normal to expose |
| 5228 | TCP | Google FCM / Play Firebase Cloud Messaging and Google Play push connections. | Normal to expose |
| 5269 | TCP | XMPP server XMPP server-to-server federation. | Normal to expose |
| 5672 | TCP | AMQP / RabbitMQ AMQP message broker (RabbitMQ). | Do not expose |
| 6667 | TCP | IRC Internet Relay Chat; also historically used by botnets. | Expose with care |
| 9092 | TCP | Kafka Apache Kafka brokers. | Do not expose |
Video and cameras 5
| 554 | TCP/UDP | RTSP Real Time Streaming Protocol, used by IP cameras and video recorders. | Do not expose |
| 1935 | TCP | RTMP Real Time Messaging Protocol for live video streaming. | Normal to expose |
| 32400 | TCP | Plex Plex Media Server. | Normal to expose |
| 34567 | TCP | XMEye / DVR Chinese DVR/NVR and camera cloud protocol (XMEye); full of known holes. | Do not expose |
| 37777 | TCP | Dahua DVR Dahua cameras and recorders service port. | Do not expose |
Other 11
| 113 | TCP | Ident Ident protocol, still queried by some IRC and mail servers. | Normal to expose |
| 515 | TCP | LPD Line printer daemon printing. | Expose with care |
| 631 | TCP/UDP | IPP / CUPS Internet Printing Protocol and CUPS printing. | Do not expose |
| 1080 | TCP | SOCKS proxy SOCKS proxy. An open one is quickly abused for spam and attacks. | Do not expose |
| 1900 | UDP | SSDP / UPnP UPnP device discovery. Exposed SSDP is a major DDoS amplifier. | Do not expose |
| 3128 | TCP | Squid proxy Squid HTTP proxy. | Do not expose |
| 3690 | TCP | Subversion SVN version control server. | Expose with care |
| 3702 | UDP | WS-Discovery Web Services Discovery used by cameras and printers; a DDoS amplifier when exposed. | Do not expose |
| 6881 | TCP/UDP | BitTorrent BitTorrent peers (6881–6889). | Normal to expose |
| 9418 | TCP | Git Git daemon (read-only git:// protocol). | Normal to expose |
| 25565 | TCP | Minecraft Minecraft Java Edition server. | Normal to expose |
This port is not in the directory. Check it with the port checker.