Common Network Ports Reference
TCP and UDP port assignments for the protocols you actually encounter. Web, email, SSH, gaming, VoIP, databases.
Common TCP/UDP ports — the ones you'll actually see
There are 65,535 possible ports per protocol. Most are unused. Here are the ~100 you'll actually run into doing network admin, gaming, or troubleshooting.
Web and remote access
| Port | Protocol | Service |
|---|---|---|
| 22 | TCP | SSH — secure shell, SFTP, SCP |
| 23 | TCP | Telnet — plaintext, avoid |
| 80 | TCP | HTTP — web, plaintext |
| 443 | TCP/UDP | HTTPS — encrypted web (UDP for HTTP/3) |
| 3389 | TCP/UDP | RDP — Windows Remote Desktop |
| 5900 | TCP | VNC — remote desktop |
| 8080 | TCP | HTTP alternative — proxies, dev servers |
| 8443 | TCP | HTTPS alternative — admin panels, proxies |
| Port | Protocol | Service |
|---|---|---|
| 25 | TCP | SMTP — server-to-server email |
| 110 | TCP | POP3 — email retrieval (legacy) |
| 143 | TCP | IMAP — email retrieval, plain |
| 465 | TCP | SMTPS — submission, implicit TLS |
| 587 | TCP | SMTP submission with STARTTLS — preferred for clients |
| 993 | TCP | IMAPS — IMAP over TLS |
| 995 | TCP | POP3S — POP3 over TLS |
File transfer and sharing
| Port | Protocol | Service |
|---|---|---|
| 20, 21 | TCP | FTP — data and control (largely deprecated) |
| 69 | UDP | TFTP — trivial FTP, used by routers/PXE |
| 137, 138 | UDP | NetBIOS Name/Datagram |
| 139 | TCP | NetBIOS Session |
| 445 | TCP | SMB — Windows file sharing, often blocked at firewalls |
| 2049 | TCP/UDP | NFS — Unix file sharing |
DNS and directory
| Port | Protocol | Service |
|---|---|---|
| 53 | UDP/TCP | DNS — UDP for queries, TCP for zone transfers and large responses |
| 853 | TCP | DNS over TLS |
| 389 | TCP | LDAP — directory access |
| 636 | TCP | LDAPS — LDAP over TLS |
| 88 | TCP/UDP | Kerberos — authentication |
Network management
| Port | Protocol | Service |
|---|---|---|
| 67, 68 | UDP | DHCP — server / client |
| 123 | UDP | NTP — network time |
| 161, 162 | UDP | SNMP — query / trap |
| 514 | UDP | Syslog |
| 500, 4500 | UDP | IPsec / IKE — VPN |
| 1194 | UDP/TCP | OpenVPN |
| 51820 | UDP | WireGuard (default) |
VoIP, video, real-time
| Port | Protocol | Service |
|---|---|---|
| 5060 | UDP/TCP | SIP — VoIP signaling |
| 5061 | TCP | SIP-TLS |
| 10000–20000 | UDP | RTP — VoIP media stream (range varies) |
| 3478 | UDP | STUN — NAT traversal |
| 5349 | TCP | TURN over TLS |
Databases
| Port | Protocol | Service |
|---|---|---|
| 1433 | TCP | Microsoft SQL Server |
| 1521 | TCP | Oracle DB |
| 3306 | TCP | MySQL / MariaDB |
| 5432 | TCP | PostgreSQL |
| 6379 | TCP | Redis |
| 27017 | TCP | MongoDB |
Common gaming ports
| Game / service | Ports |
|---|---|
| Xbox Live | TCP 3074, UDP 88, 500, 3074, 3544, 4500 |
| PlayStation Network | TCP 80, 443, 1935, 3478–3480; UDP 3478–3479 |
| Steam | TCP 27015–27050; UDP 27000–27100 |
| Minecraft (Java) | TCP 25565 |
| Minecraft (Bedrock) | UDP 19132 |
| Discord (voice) | UDP 50000–65535 |
Port ranges by category
- 0–1023: Well-known / system ports. Reserved for "real" services.
- 1024–49151: Registered ports. Assigned by IANA but anyone can use them.
- 49152–65535: Ephemeral / dynamic ports. Outbound connections grab one of these as their source port.
How port numbers actually get used in real networks
Port numbers identify which service on a host a connection is destined for. The IP address gets a packet to the right machine; the port number gets it to the right process on that machine. TCP and UDP each have their own separate space of 65,536 possible port numbers.
The lower ports (0-1023) are called well-known ports and are reserved for standard services. Ports 1024-49151 are registered ports assigned by IANA to various applications. Ports 49152-65535 are the dynamic/private range, used for ephemeral connections initiated by clients.
The convention that servers listen on well-known ports and clients connect from ephemeral ports is what lets a firewall or a NAT gateway distinguish inbound service traffic from outbound client traffic. When your browser opens a connection to example.com on port 443, it does so from a random ephemeral port on your machine. The server responds to that ephemeral port, and your OS's connection tracking associates the response with the browser process that originated the request.
The ports I care about most in day-to-day admin work
Ports 22, 80, 443, 3389
SSH, HTTP, HTTPS, and RDP. These are the four ports I most often deal with in firewall configurations. SSH for administrative access to Linux systems. HTTP and HTTPS for web services. RDP for Windows remote desktop.
Rule of thumb for exposing these to the internet: SSH should only be accessible from known IP addresses or via a bastion host, HTTP/HTTPS is fine to expose but should redirect HTTP to HTTPS, RDP should never be directly exposed (use a VPN or Zero Trust access instead).
Ports 25, 465, 587, 993, 995, 143, 110
Email. Port 25 is SMTP between mail servers (often blocked outbound by residential ISPs). Port 587 is SMTP submission for authenticated clients (starttls). Port 465 is SMTPS (implicit TLS SMTP, controversial but widely used). Port 993 is IMAPS. Port 995 is POP3S. Ports 143 and 110 are the legacy plain versions of IMAP and POP3 — should not be used in 2026.
Small business email troubleshooting almost always involves at least a few of these ports. Knowing which is which speeds up diagnosis considerably.
Ports 53, 5353, 853
DNS. Port 53 (both TCP and UDP) is standard DNS. Port 5353 is mDNS (multicast DNS, used by Bonjour and similar). Port 853 is DNS-over-TLS.
Ports 67, 68
DHCP. Server on port 67, client on port 68. Blocking DHCP traffic breaks address assignment for anything using the network, so these are almost never firewalled.
Ports 123
NTP. Time synchronization. Should be allowed outbound so systems can maintain accurate clocks (essential for TLS certificate validation, log correlation, Kerberos, and many other things).
Ports 445, 137, 138, 139
SMB/CIFS file sharing. Port 445 is modern SMB. Ports 137-139 are older NetBIOS-based sharing. Should never be exposed to the internet — the WannaCry ransomware notably exploited port 445 exposed by carelessly-configured firewalls.
Ports 3306, 5432, 1433, 27017
MySQL, PostgreSQL, MSSQL, MongoDB. Database ports. Should not be exposed to the internet under any normal circumstances. Access should be from application servers only, through internal networks or VPN.
Ports 5060, 5061, 10000-20000
SIP. Port 5060 is standard SIP, port 5061 is SIP over TLS. RTP media traffic uses a range of UDP ports, commonly 10000-20000 but varies by PBX configuration. VoIP admins deal with all of these routinely.
Firewall considerations by port
Never-expose-to-internet ports
Ports that should essentially never be reachable from the public internet, no matter who your users are or what you're trying to accomplish: 445 (SMB), 3389 (RDP), 3306 (MySQL), 5432 (PostgreSQL), 1433 (MSSQL), 27017 (MongoDB), 5900 (VNC), 111 (RPC), 2049 (NFS), and various others that expose administrative or database services.
Exposing these directly leads to compromise very quickly. Instead, put them behind a VPN, a Zero Trust access solution, or an SSH bastion host.
Expose-carefully ports
Ports that can legitimately be exposed but require thoughtful configuration: 22 (SSH — key-only auth, from restricted IPs, fail2ban), 25 (SMTP — for mail servers only, with proper anti-spam), 80 and 443 (HTTP/HTTPS — behind a WAF for anything sensitive), 21 (FTP — really, replace with SFTP instead).
Ports that can be exposed freely
Ports where exposure is the point: 80 and 443 for web servers, 25 for public mail servers, 53 for authoritative DNS. These serve their function by being reachable from anywhere.
Common port-related troubleshooting scenarios
"Some services work but not others"
Usually a firewall issue. Check what specific port the failing service uses and whether it's allowed through every firewall between the client and server. Include the local host's firewall, the LAN's firewall, any intermediate cloud provider's security groups, and the destination host's firewall.
"The service is running but nothing can connect"
Verify with a local port scan that the service is actually listening on the port you think it is, and on the interface you think it is. netstat -tuln on Linux, ss -tuln on modern Linux, netstat -an on Windows.
Common gotcha: a service configured to listen only on 127.0.0.1 will accept local connections but nothing from the network. Change the bind address to 0.0.0.0 (all interfaces) or a specific network interface.
"Everything worked yesterday, now nothing works"
Something changed. Common culprits: firewall rule updated, service restarted with different config, cloud security group modified, ISP changed something upstream. Check recent changes first.
"Some ports are blocked by my ISP"
Residential ISPs commonly block outbound port 25 (SMTP) to prevent spam. Some block inbound low ports entirely. If you're trying to run a service that expects to receive on port 25, 80, 443, or similar, and it doesn't work from home, this is often the reason. Business internet service typically doesn't have these restrictions.
Ephemeral port ranges by OS
- Windows: 49152-65535 by default
- Linux: 32768-60999 by default (varies by distribution)
- macOS: 49152-65535 by default
- FreeBSD: 49152-65535 by default
When you open a client connection from your machine, the OS picks an available port from this range and uses it as the source port. The range is different by OS which occasionally matters for firewalls with source-port restrictions.
Related tools
To understand what a specific IP is (before deciding whether to allow it through a firewall), use the IP Lookup tool. For subnet-based firewall rule planning, use the Subnet Calculator. For checking whether the actual service running on a public site accepts what it claims to, the SSL/TLS Cert Inspector connects to a specific host and port and shows what certificate is presented (useful for verifying that HTTPS services are actually reachable and using the right cert).