Common Network Ports Reference Guide for IT Support - IT Troubleshooting Knowledge Base

Knowing which ports correspond to which services is fundamental to IT troubleshooting and network administration. Whether you are configuring a firewall rule, diagnosing a connectivity failure, investigating a security incident, or provisioning a new server, this reference gives you the port numbers, protocols, and service descriptions you need in one place. All ports listed here are well-known (0–1023) or registered (1024–49151) ports as defined by the Internet Assigned Numbers Authority (IANA).

Email Ports

Email relies on a collection of protocols for sending and receiving messages between servers and clients. Understanding the differences — particularly between the deprecated plain-text ports and their secure TLS equivalents — is essential for email configuration and security hardening.

Port	Protocol	Service	Description
25	TCP	SMTP	Simple Mail Transfer Protocol — server-to-server email relay. Should not be open outbound from end-user devices; only mail servers need it. Commonly blocked by ISPs to prevent spam.
143	TCP	IMAP	Internet Message Access Protocol — client access to mailboxes over plain text. Deprecated in favour of IMAPS (993). Should be disabled if 993 is available.
465	TCP	SMTPS	SMTP over implicit TLS (SSL). Originally an unofficial port, now officially assigned for message submission with TLS. Used by some mail clients and legacy systems.
587	TCP	SMTP Submission	The preferred port for authenticated email submission from clients to their outgoing mail server. Requires STARTTLS and user authentication. Use this instead of port 25 for client sending.
993	TCP	IMAPS	IMAP over SSL/TLS — the secure version of IMAP. All email clients should be configured to use this port rather than 143.
995	TCP	POP3S	POP3 over SSL/TLS — secure Post Office Protocol version 3. Used for downloading email from a server to a local client. Less common than IMAPS in modern environments.
110	TCP	POP3	Post Office Protocol 3 — plain-text email retrieval. Deprecated in favour of POP3S (995). Disable if not required.

In Microsoft 365 and Google Workspace environments, standard SMTP relay uses port 587 with TLS and modern authentication. Port 25 is used exclusively for server-to-server relay. If users cannot send email, first check whether port 587 is open and not blocked by a local firewall or ISP.

Web Ports

Port	Protocol	Service	Description
80	TCP	HTTP	Hypertext Transfer Protocol — unencrypted web traffic. Modern web servers redirect all port 80 traffic to HTTPS (443). Should not carry sensitive data.
443	TCP	HTTPS	HTTP over TLS/SSL — encrypted web traffic. All modern web services use this port. Required for Microsoft 365, Google Workspace, and virtually every cloud service.
8080	TCP	HTTP Alternate	Alternate HTTP port commonly used for development servers, proxy servers, and web management consoles when port 80 is already in use.
8443	TCP	HTTPS Alternate	Alternate HTTPS port used by some web applications and management interfaces (e.g., Tomcat, Cisco web UIs) when port 443 is occupied.

Remote Access Ports

Port	Protocol	Service	Description
22	TCP	SSH	Secure Shell — encrypted command-line remote access to Unix/Linux/macOS systems and network devices. Also used for SFTP (Secure File Transfer Protocol) and SCP. Change the default port or restrict access by IP to reduce brute-force attempts.
23	TCP	Telnet	Unencrypted remote terminal protocol. Do not use — all traffic is sent in plain text. Disable on all managed devices and replace with SSH.
3389	TCP/UDP	RDP	Remote Desktop Protocol — Microsoft’s graphical remote access protocol for Windows desktops and servers. Expose only through a VPN or RD Gateway to prevent brute-force and ransomware attacks on directly internet-exposed RDP.
5900	TCP	VNC	Virtual Network Computing — cross-platform screen sharing and remote control. Base port; subsequent displays use 5901, 5902, etc. Secure with a VPN or SSH tunnel as VNC transmits minimal encryption by default.
5800	TCP	VNC (Web)	VNC over HTTP/browser-based access. Same security considerations as port 5900.

Exposing RDP (port 3389) directly to the internet is one of the most common vectors for ransomware attacks. Always place RDP behind a VPN, an RD Gateway, or restrict by IP allowlist. Enable Network Level Authentication (NLA) as a minimum protection.

Directory Services Ports

Directory services ports are critical in Active Directory and LDAP environments. Firewall rules for domain controllers, application servers, and client devices must permit these ports.

Port	Protocol	Service	Description
88	TCP/UDP	Kerberos	Kerberos authentication protocol — used by Active Directory for issuing and validating authentication tickets (TGTs and service tickets). Required between all domain members and domain controllers.
389	TCP/UDP	LDAP	Lightweight Directory Access Protocol — directory queries and management over plain text. Used by applications that query Active Directory user and group information. Prefer LDAPS (636) for sensitive operations.
636	TCP	LDAPS	LDAP over SSL/TLS — encrypted directory access. Required for secure LDAP queries. All new LDAP integrations should use 636 rather than 389.
3268	TCP	GC LDAP	Global Catalog LDAP — queries the Global Catalog for forest-wide searches in multi-domain Active Directory forests. Used by Exchange and other AD-integrated applications.
3269	TCP	GC LDAPS	Global Catalog LDAP over SSL — encrypted version of 3268.
445	TCP	SMB (also see File Sharing)	Also used by Active Directory for SYSVOL/NETLOGON share replication and Group Policy application.
464	TCP/UDP	Kpasswd	Kerberos password change protocol — used when changing domain passwords.

Microsoft’s guidance for Active Directory firewall port requirements is detailed at https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/config-firewall-for-ad-domains-and-trusts. In addition to the ports above, RPC dynamic ports (49152–65535) are required for domain controller communication unless the RPC port range is restricted via registry.

Port	Protocol	Service	Description
445	TCP	SMB	Server Message Block — Windows file and printer sharing. Used for accessing UNC paths (`\\server\share`). SMB 3.x (Windows 10/Server 2016+) supports encryption. Block port 445 at the perimeter firewall — it should never be exposed to the internet.
137	UDP	NetBIOS Name Service	Legacy NetBIOS name resolution. Required for older Windows clients using WINS. Disable if all clients support DNS-based resolution.
138	UDP	NetBIOS Datagram Service	Legacy NetBIOS datagram service. Generally not required in modern environments.
139	TCP	NetBIOS Session Service	Older SMB over NetBIOS (SMBv1). Disable SMBv1 on all systems — it was exploited by WannaCry and NotPetya ransomware.
21	TCP	FTP Control	File Transfer Protocol — control channel for FTP connections. Plain text, including credentials. Replace with SFTP (port 22) or FTPS wherever possible.
20	TCP	FTP Data (Active)	FTP active mode data transfer. Problematic with firewalls and NAT; passive mode (random high port) is preferred.
989	TCP	FTPS Data	FTP data channel over TLS (explicit or implicit).
990	TCP	FTPS Control	FTP control channel over implicit TLS. More secure than standard FTP.
2049	TCP/UDP	NFS	Network File System — Unix/Linux file sharing protocol. Version 4 uses TCP only and is preferred. Restrict to trusted network segments.

VPN Ports

Port	Protocol	Service	Description
500	UDP	IKE / IPSec	Internet Key Exchange — used to establish IPSec VPN tunnels. Required on both the VPN server and client side.
4500	UDP	IPSec NAT-T	IPSec NAT Traversal — allows IPSec to traverse NAT devices. Used alongside port 500 when clients are behind NAT. Required for most IKEv2 and L2TP/IPSec VPN clients.
1194	UDP/TCP	OpenVPN	OpenVPN’s default port. UDP is preferred for performance; TCP port 1194 or 443 is used when UDP is blocked or to blend with HTTPS traffic.
1723	TCP	PPTP	Point-to-Point Tunnelling Protocol. Deprecated — known security vulnerabilities. Do not use PPTP in new deployments; replace with IKEv2/IPSec or OpenVPN.
1701	UDP	L2TP	Layer 2 Tunnelling Protocol — used with IPSec for L2TP/IPSec VPNs. The combination is secure; L2TP alone provides no encryption.
443	TCP	SSL VPN	Many modern SSL/TLS-based VPN solutions (Cisco AnyConnect, GlobalProtect, OpenVPN TCP mode) use port 443 to blend with regular HTTPS traffic and avoid firewall blocks.
51820	UDP	WireGuard	WireGuard VPN protocol — default port. WireGuard is a modern, high-performance VPN protocol increasingly adopted as an alternative to OpenVPN and IPSec.

Other Common Ports

Port	Protocol	Service	Description
53	TCP/UDP	DNS	Domain Name System — name resolution. UDP for standard queries; TCP for large responses and zone transfers. Block TCP/53 zone transfers from unauthorised hosts.
67/68	UDP	DHCP	Dynamic Host Configuration Protocol — 67 (server to client broadcast), 68 (client to server). Required between DHCP clients, relay agents, and servers.
123	UDP	NTP	Network Time Protocol — time synchronisation. Required for Kerberos authentication (clocks must be within 5 minutes). Windows domain members use the domain hierarchy for NTP.
161/162	UDP	SNMP	Simple Network Management Protocol — 161 for polling managed devices, 162 for traps (alerts from devices to the management station). Use SNMPv3 with authentication and encryption.
514	UDP	Syslog	Remote logging — devices send log messages to a centralised syslog server. Use TCP/514 or TLS syslog (6514) for reliable and encrypted log delivery.
3306	TCP	MySQL/MariaDB	MySQL and MariaDB database server. Restrict to localhost or application server IPs — never expose to the internet.
5432	TCP	PostgreSQL	PostgreSQL database server. Same security guidance as MySQL.
1433	TCP	MS SQL Server	Microsoft SQL Server database. Restrict access to application servers and DBA workstations via firewall rules.

Use netstat -ano (Windows) or ss -tulnp (Linux) to see which ports are currently open and listening on a system. Cross-reference against this table to identify any unexpected services.

​Email Ports

​Web Ports

​Remote Access Ports

​Directory Services Ports

​File Sharing Ports

​VPN Ports

​Other Common Ports

Email Ports

Web Ports

Remote Access Ports

Directory Services Ports

File Sharing Ports

VPN Ports

Other Common Ports