prefixkit Ask an engineerAsk RU

Port 69 TFTP

Trivial FTP without authentication. Used to provision IP phones and network boot (PXE).

Protocol
UDP
Service
TFTP
Category
File sharing
Exposing to the internet
Do not expose

This is a UDP port: UDP reachability cannot be tested reliably with a simple connect; check firewall rules and packet counters.

Is it safe to open

File-sharing protocols are not designed for the internet: they leak data and spread ransomware. Keep them inside the LAN and give remote users a VPN or an HTTPS-based service instead.

How to open port 69

Open to everyone

# Linux iptables
iptables -A INPUT -p udp --dport 69 -j ACCEPT
# Ubuntu ufw
ufw allow 69/udp
# firewalld
firewall-cmd --permanent --add-port=69/udp && firewall-cmd --reload
# MikroTik
/ip firewall filter add chain=input protocol=udp dst-port=69 action=accept place-before=0 comment="port 69"
# Windows (PowerShell)
New-NetFirewallRule -DisplayName "Port 69 UDP" -Direction Inbound -Protocol UDP -LocalPort 69 -Action Allow

Only for your addresses

# allow only one address or network (replace 203.0.113.0/24)
iptables -A INPUT -p udp --dport 69 -s 203.0.113.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 69 -j DROP
ufw allow from 203.0.113.0/24 to any port 69 proto udp
/ip firewall filter add chain=input protocol=udp dst-port=69 src-address=203.0.113.0/24 action=accept
/ip firewall filter add chain=input protocol=udp dst-port=69 action=drop

If the server is behind a router, you also need a port forward (dst-nat). Behind ISP CGNAT (100.64.0.0/10 on the WAN) forwarding will not help: you need a public IP or a VPN.

What is listening

Check on the server

# what listens on the port
ss -lntup | grep ':69 '
netstat -ano | findstr :69   # Windows
lsof -i :69   # macOS

Related ports