ls ~/ports
Ports.
Which service runs on which port, what belongs on the internet and what does not — and how to check it.
| Port | Protocol | Service | Exposure |
|---|---|---|---|
| 20-21 | TCP | FTP | Public: only if required, prefer SFTP |
| 22 | TCP | SSH / SFTP | Public: yes, key-only, ideally IP-restricted |
| 25 | TCP | SMTP (MTA-to-MTA) | Public: yes, inbound for the MX |
| 53 | TCP/UDP | DNS | Public: only for authoritative nameservers |
| 80 | TCP | HTTP | Public: yes, for redirects and ACME |
| 110 | TCP | POP3 | Public: better closed, use 995 |
| 123 | UDP | NTP | Public: no, outbound only |
| 143 | TCP | IMAP | Public: possible, prefer 993 only |
| 389 | TCP/UDP | LDAP | Public: no, internal only |
| 443 | TCP/UDP | HTTPS / HTTP/3 | Public: yes |
| 465 | TCP | SMTP Submission (implicit TLS) | Public: yes, for mail clients |
| 587 | TCP | SMTP Submission | Public: yes, for mail clients |
| 636 | TCP | LDAPS | Public: no, internal only |
| 853 | TCP/UDP | DNS over TLS / DNS over QUIC | Public: only for your own DoT resolver |
| 993 | TCP | IMAPS | Public: yes, for mail clients |
| 995 | TCP | POP3S | Public: only if POP3 is actually used |
| 1194 | UDP | OpenVPN | Public: yes, for VPN clients |
| 2049 | TCP/UDP | NFS | Public: no, LAN or VPN only |
| 3306 | TCP | MySQL / MariaDB | Public: no, localhost or app server only |
| 3389 | TCP/UDP | RDP | Public: no, VPN or gateway only |
| 3478 | TCP/UDP | STUN / TURN (coturn, Nextcloud Talk) | Public: yes, TCP+UDP plus relay ports |
| 4190 | TCP | ManageSieve | Public: usually no, internal for webmail |
| 5432 | TCP | PostgreSQL | Public: no, app servers only |
| 6379 | TCP | Redis | Public: no, localhost only |
| 8080 | TCP | HTTP alternate | Public: usually no, behind a reverse proxy |
| 8443 | TCP | HTTPS alternate / Plesk | Public: admin IPs only |
| 9000 | TCP | PHP-FPM (FastCGI) | Public: no, localhost only |
| 9090 | TCP | Prometheus / Cockpit | Public: no, internal or behind a proxy |
| 9100 | TCP | Prometheus node_exporter | Public: no, only for the Prometheus server |
| 11211 | TCP/UDP | Memcached | Public: no, localhost only |
| 51820 | UDP | WireGuard | Public: yes, for VPN peers |