Common TCP/UDP ports and when to open them

Published: 2026-09-05

What TCP and UDP port numbers mean, how well-known vs ephemeral ranges work, and when to allow common services in firewalls without over-exposing your network.

A port number is a 16-bit integer (0–65535) that tells an operating system which process should receive a packet for a given IP address. Together, protocol + IP + port identify a listening endpoint: TCP 10.0.0.5:443 is not the same socket as UDP 10.0.0.5:53. Firewall tickets, Docker EXPOSE lines, and security group diffs all hinge on getting that triple right.

This guide covers TCP vs UDP, IANA-style ranges, everyday well-known services, and a practical “when to open” checklist. For the IP/CIDR side of the same rules, see Subnet math and CIDR explained and Bulk-checking IPs against firewall and ACL CIDR allow lists.

TCP vs UDP in one minute

	TCP	UDP
Delivery	Ordered, reliable stream	Datagrams; no built-in retry
Connection	Handshake before data	Usually connectionless
Typical uses	HTTP(S), SSH, databases, SMTP	DNS queries, NTP, DHCP, many VPNs, game/VoIP media
Firewall note	Stateful allow of established flows is common	Often needs explicit inbound and return-path thinking

Some services use both (DNS on 53, LDAP on 389). Opening “TCP 53” alone does not fix UDP-based resolution. Always match protocol and port to how the client actually speaks.

Port ranges (well-known, registered, ephemeral)

Range	Name (common shorthand)	Who picks it
0–1023	Well-known / system	Classic IANA services (HTTP 80, SSH 22, …); often privileged on Unix
1024–49151	Registered / user	Vendor defaults (PostgreSQL 5432, Redis 6379, RDP 3389)
49152–65535	Dynamic / ephemeral	Client source ports for outbound connections

Listening services usually sit in the first two ranges. Clients pick ephemeral source ports unless you pin them. Confusing a server’s destination port with a random source port is a common cause of “firewall opened 5432 but the capture shows 49180.”

Port 0 is reserved; do not put it in allow lists. Software can also bind non-default ports (HTTPS on 8443, SSH on 2222)—a reference table tells you the conventional number, not what your host actually runs.

Everyday ports you will see in tickets

Port	Protocol	Service	Typical exposure
22	TCP	SSH / SFTP	Jump hosts, bastions; rarely the whole internet without MFA/keys
53	TCP + UDP	DNS	Resolvers and authoritative servers; clients usually outbound only
80	TCP	HTTP	Public web or redirect-to-HTTPS; prefer 443 for real traffic
443	TCP	HTTPS	Public web APIs and sites; the default “open to the world” web port
123	UDP	NTP	Time sync; usually outbound from hosts, inbound only on NTP servers
25 / 587 / 465	TCP	SMTP / submission / SMTPS	Mail servers and submission; residential ISPs often block 25 outbound
3306 / 5432 / 6379	TCP	MySQL, Postgres, Redis	Private VPC / VPN only—almost never public
3389	TCP	RDP	Admin jump paths with strong auth; high-value attack surface if public
6443	TCP	Kubernetes API	Control plane; cluster admin networks only

Categories in ops docs often group the same idea: web, remote access, database, email, monitoring, security/VPN. When you are unsure whether a number is “the Postgres port” or “something else on 5432,” look it up rather than guessing from memory.

When to open a port (and when not to)

Use this order before widening a security group or ufw allow:

Who needs to reach it? A public CDN edge is different from one admin laptop. Prefer source CIDRs over 0.0.0.0/0 whenever you can. Summarize overlapping ranges with CIDR Aggregator; check membership with IP in CIDR Checker.
Is the process listening on that interface? Opening 443 does nothing if nginx binds only to 127.0.0.1. Confirm with ss / netstat / cloud “listening ports” views.
TCP, UDP, or both? Match the protocol the service uses. “Both” in a reference table means you may need two rules.
Default vs configured port? Document the configured port in the runbook. Defaults are hints for greenfield installs.
Encrypted equivalent available? Prefer 443 over 80, 636 over 389, 993 over 143, Docker API 2376 over 2375—when the stack supports it.
Can it stay private? Databases, message brokers, Redis, etcd, and Kubernetes APIs belong behind VPN, private subnets, or mesh—not on the public internet “just for a quick test.”

Opening a port is not authentication. It only removes a network obstacle. Pair allow rules with TLS, identity, and least privilege.

Firewall and compose pitfalls

Ephemeral replies — Stateful firewalls track TCP handshakes; naive UDP ACLs sometimes miss return traffic. Test with a real client, not only a port scanner.
Health checks — Load balancers may probe a different port than user traffic. Allow the probe path from the LB subnet only.
Container vs host ports — 5432:5432 in Compose publishes on the host; binding 127.0.0.1:5432:5432 keeps it local. Publishing to 0.0.0.0 on a laptop VPN is still a wide open door on that interface.
Legacy services — Telnet (23), plaintext FTP (21), and old NetBIOS ports are rarely worth opening on modern networks; prefer SSH/SFTP and current directory protocols.
Same number, different meaning — Port 5000 appears as UPnP and as many local web apps; 8080 is a popular alternate HTTP. Always pair number with service name in tickets.

Why look ports up locally

Firewall change tickets often include customer CIDRs, hostnames, and ticket IDs. Pasting “what is port 2379?” into a random web search is fine for trivia; pasting a full ACL draft into a third-party “port lookup” that logs queries is not. A browser-bundled table filters and copies in your browser with no network call per search—same privacy model as other LocalTools. See Why “local only” matters for developer tools.

Caveats that still apply offline:

The table is a practical subset of common web, infra, database, and ops ports—not the entire IANA registry.
Custom and vendor-specific ports may be missing; verify against your product docs and ss -lntp on the host.

Try it locally

Use the Port Number Reference to:

Search by port number, service name, or notes (443, ssh, postgres, prometheus).
Filter by protocol (TCP, UDP, or both) and category (web, database, remote access, monitoring, …).
Copy the port alone or a port/protocol pair for firewall rules and runbooks.

Related LocalTools for the same change window: Subnet Calculator for single-prefix math, CIDR Aggregator for summarizing allow lists, and IP in CIDR Checker for bulk membership checks.