Networking & DNS

Common server ports and what uses them

A practical list of the ports you meet on a VPS, from SSH and web to mail, databases and Remote Desktop, with the protocol and whether each should be public or private.

Beginner5 min read

Firewall rules, error messages and setup guides all talk in port numbers. This page lists the ports you are most likely to meet on a VPS, what uses them, whether they run over TCP or UDP, and whether they should be open to the internet. Use it as a reference when you plan firewall rules.

Before you start

  • A port is a number from 0 to 65535 that lets one IP address run many services. The combination of IP, port and protocol identifies a service, for example TCP port 443 on 203.0.113.10.
  • TCP and UDP ports are separate. TCP 53 and UDP 53 are different doors. Firewall rules must name the right one. See TCP vs UDP explained.
  • Ports below 1024 are "well-known" ports. On Linux, only root (or a program granted the right capability) can listen on them.
  • The numbers below are the defaults. Any service can be moved to another port.

Remote access

  • 22 TCP, SSH and SFTP: command-line access and secure file transfer on Linux. Public, but protect it with keys, Fail2ban or an IP allowlist. Some people move it to another port to cut log noise.
  • 3389 TCP and UDP, Remote Desktop (RDP): the standard Windows default. Windows servers use TCP 3389 by default, so you connect as 203.0.113.10:3389. Keep 3389 allowed in Windows Firewall at all times.
  • 5900 TCP, VNC: remote desktop on Linux. Never expose it directly; tunnel it over SSH.
  • 23 TCP, Telnet: unencrypted and obsolete. Keep it closed.

Warning: Before you turn on a default-deny firewall, allow your remote access port first: SSH (22 or your custom port) on Linux, or TCP 3389 on a Windows server. If you lock yourself out, the browser console in your VPS provider's control panel still works.

Web

  • 80 TCP, HTTP: plain web traffic. Keep it public so visitors and Let's Encrypt can reach the server, and redirect it to HTTPS.
  • 443 TCP, HTTPS: encrypted web traffic. Public.
  • 443 UDP, HTTP/3 (QUIC): only needed if your web server has HTTP/3 turned on.
  • 8080, 8000, 3000, 5000 TCP: common development and app server ports, such as Node.js or Python apps. Keep them on localhost and put Nginx or another reverse proxy in front.

Email

  • 25 TCP, SMTP: server-to-server mail delivery. Needed only on a mail server. Many networks filter outbound 25 to fight spam.
  • 587 TCP, submission: mail clients sending through your server with authentication.
  • 465 TCP, SMTPS: submission with TLS from the start. Still widely used.
  • 143 and 993 TCP, IMAP / IMAPS: reading mail. Prefer 993.
  • 110 and 995 TCP, POP3 / POP3S: older mail download. Prefer 995.

DNS and time

  • 53 UDP and TCP, DNS: open to the public only if the server is an authoritative name server. A recursive resolver open to the internet will be abused for attacks.
  • 123 UDP, NTP: time sync. The server needs outbound access; inbound is rarely needed.

Databases and caches

Keep all of these private. Bind them to 127.0.0.1 or allow only specific app server IPs.

  • 3306 TCP: MySQL and MariaDB.
  • 5432 TCP: PostgreSQL.
  • 27017 TCP: MongoDB.
  • 6379 TCP: Redis.
  • 11211 TCP: Memcached. Never public; it has been used in large amplification attacks.
  • 1433 TCP: Microsoft SQL Server.

To reach a database from your own computer, use an SSH tunnel instead of opening the port.

File sharing and Windows services

  • 21 TCP, FTP: unencrypted logins. Use SFTP on port 22 instead, or FTPS if a client requires FTP.
  • 445 TCP, SMB: Windows file sharing. Never expose it to the internet.
  • 135, 137–139: older Windows networking. Keep closed to the public.
  • 5985 and 5986 TCP, WinRM: PowerShell remoting. Allow only from trusted IPs.

Control panels

These are the vendors' common defaults. Check your panel's documentation for the current list.

  • 2083, 2087 TCP: cPanel and WHM over HTTPS.
  • 8443 TCP: Plesk over HTTPS.
  • 2222 TCP: DirectAdmin.

Restrict panel ports to your own IP where you can.

VPN

  • 51820 UDP: WireGuard's usual default.
  • 1194 UDP: OpenVPN's default. It can also run over TCP.
  • 500 and 4500 UDP: IPsec / IKEv2.

Check it works

To see which of these ports your server actually uses:

Bash
sudo ss -tulpn

On Windows:

PowerShell
Get-NetTCPConnection -State Listen | Sort-Object LocalPort | Format-Table LocalAddress, LocalPort, OwningProcess

Compare the result with this list. Anything public that should be private needs a firewall rule or a localhost binding.

Troubleshooting

  • A service runs but the port is not in the list above: check its config file or ss -tulpn for the real port. Defaults are often changed.
  • You allowed TCP but the service still fails: it may use UDP, such as DNS, WireGuard or HTTP/3.
  • Outbound mail on 25 never arrives: many providers and networks filter it. See Port 25 blocked on a VPS.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AIOpen a ticket

Related guides