> ## Documentation Index
> Fetch the complete documentation index at: https://docs.derekdinh.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Common Network Ports Reference Guide for IT Support
> A complete reference of TCP and UDP ports IT staff need to know, covering email, web, remote access, directory services, file sharing, and VPN.
Knowing which ports correspond to which services is fundamental to IT troubleshooting and network administration. Whether you are configuring a firewall rule, diagnosing a connectivity failure, investigating a security incident, or provisioning a new server, this reference gives you the port numbers, protocols, and service descriptions you need in one place. All ports listed here are well-known (0–1023) or registered (1024–49151) ports as defined by the Internet Assigned Numbers Authority (IANA).
## Email Ports
Email relies on a collection of protocols for sending and receiving messages between servers and clients. Understanding the differences — particularly between the deprecated plain-text ports and their secure TLS equivalents — is essential for email configuration and security hardening.
| Port | Protocol | Service | Description |
| ------- | -------- | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **25** | TCP | SMTP | Simple Mail Transfer Protocol — server-to-server email relay. Should **not** be open outbound from end-user devices; only mail servers need it. Commonly blocked by ISPs to prevent spam. |
| **143** | TCP | IMAP | Internet Message Access Protocol — client access to mailboxes over plain text. Deprecated in favour of IMAPS (993). Should be disabled if 993 is available. |
| **465** | TCP | SMTPS | SMTP over implicit TLS (SSL). Originally an unofficial port, now officially assigned for message submission with TLS. Used by some mail clients and legacy systems. |
| **587** | TCP | SMTP Submission | The preferred port for authenticated email submission from clients to their outgoing mail server. Requires STARTTLS and user authentication. Use this instead of port 25 for client sending. |
| **993** | TCP | IMAPS | IMAP over SSL/TLS — the secure version of IMAP. All email clients should be configured to use this port rather than 143. |
| **995** | TCP | POP3S | POP3 over SSL/TLS — secure Post Office Protocol version 3. Used for downloading email from a server to a local client. Less common than IMAPS in modern environments. |
| **110** | TCP | POP3 | Post Office Protocol 3 — plain-text email retrieval. Deprecated in favour of POP3S (995). Disable if not required. |
In Microsoft 365 and Google Workspace environments, standard SMTP relay uses port **587** with TLS and modern authentication. Port **25** is used exclusively for server-to-server relay. If users cannot send email, first check whether port 587 is open and not blocked by a local firewall or ISP.
***
## Web Ports
| Port | Protocol | Service | Description |
| -------- | -------- | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **80** | TCP | HTTP | Hypertext Transfer Protocol — unencrypted web traffic. Modern web servers redirect all port 80 traffic to HTTPS (443). Should not carry sensitive data. |
| **443** | TCP | HTTPS | HTTP over TLS/SSL — encrypted web traffic. All modern web services use this port. Required for Microsoft 365, Google Workspace, and virtually every cloud service. |
| **8080** | TCP | HTTP Alternate | Alternate HTTP port commonly used for development servers, proxy servers, and web management consoles when port 80 is already in use. |
| **8443** | TCP | HTTPS Alternate | Alternate HTTPS port used by some web applications and management interfaces (e.g., Tomcat, Cisco web UIs) when port 443 is occupied. |
***
## Remote Access Ports
| Port | Protocol | Service | Description |
| -------- | -------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **22** | TCP | SSH | Secure Shell — encrypted command-line remote access to Unix/Linux/macOS systems and network devices. Also used for SFTP (Secure File Transfer Protocol) and SCP. Change the default port or restrict access by IP to reduce brute-force attempts. |
| **23** | TCP | Telnet | Unencrypted remote terminal protocol. **Do not use** — all traffic is sent in plain text. Disable on all managed devices and replace with SSH. |
| **3389** | TCP/UDP | RDP | Remote Desktop Protocol — Microsoft's graphical remote access protocol for Windows desktops and servers. Expose only through a VPN or RD Gateway to prevent brute-force and ransomware attacks on directly internet-exposed RDP. |
| **5900** | TCP | VNC | Virtual Network Computing — cross-platform screen sharing and remote control. Base port; subsequent displays use 5901, 5902, etc. Secure with a VPN or SSH tunnel as VNC transmits minimal encryption by default. |
| **5800** | TCP | VNC (Web) | VNC over HTTP/browser-based access. Same security considerations as port 5900. |
Exposing RDP (port 3389) directly to the internet is one of the most common vectors for ransomware attacks. Always place RDP behind a VPN, an RD Gateway, or restrict by IP allowlist. Enable Network Level Authentication (NLA) as a minimum protection.
***
## Directory Services Ports
Directory services ports are critical in Active Directory and LDAP environments. Firewall rules for domain controllers, application servers, and client devices must permit these ports.
| Port | Protocol | Service | Description |
| -------- | -------- | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **88** | TCP/UDP | Kerberos | Kerberos authentication protocol — used by Active Directory for issuing and validating authentication tickets (TGTs and service tickets). Required between all domain members and domain controllers. |
| **389** | TCP/UDP | LDAP | Lightweight Directory Access Protocol — directory queries and management over plain text. Used by applications that query Active Directory user and group information. Prefer LDAPS (636) for sensitive operations. |
| **636** | TCP | LDAPS | LDAP over SSL/TLS — encrypted directory access. Required for secure LDAP queries. All new LDAP integrations should use 636 rather than 389. |
| **3268** | TCP | GC LDAP | Global Catalog LDAP — queries the Global Catalog for forest-wide searches in multi-domain Active Directory forests. Used by Exchange and other AD-integrated applications. |
| **3269** | TCP | GC LDAPS | Global Catalog LDAP over SSL — encrypted version of 3268. |
| **445** | TCP | SMB (also see File Sharing) | Also used by Active Directory for SYSVOL/NETLOGON share replication and Group Policy application. |
| **464** | TCP/UDP | Kpasswd | Kerberos password change protocol — used when changing domain passwords. |
Microsoft's guidance for Active Directory firewall port requirements is detailed at `https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/config-firewall-for-ad-domains-and-trusts`. In addition to the ports above, RPC dynamic ports (49152–65535) are required for domain controller communication unless the RPC port range is restricted via registry.
***
## File Sharing Ports
| Port | Protocol | Service | Description |
| -------- | -------- | ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **445** | TCP | SMB | Server Message Block — Windows file and printer sharing. Used for accessing UNC paths (`\\server\share`). SMB 3.x (Windows 10/Server 2016+) supports encryption. **Block port 445 at the perimeter firewall** — it should never be exposed to the internet. |
| **137** | UDP | NetBIOS Name Service | Legacy NetBIOS name resolution. Required for older Windows clients using WINS. Disable if all clients support DNS-based resolution. |
| **138** | UDP | NetBIOS Datagram Service | Legacy NetBIOS datagram service. Generally not required in modern environments. |
| **139** | TCP | NetBIOS Session Service | Older SMB over NetBIOS (SMBv1). Disable SMBv1 on all systems — it was exploited by WannaCry and NotPetya ransomware. |
| **21** | TCP | FTP Control | File Transfer Protocol — control channel for FTP connections. Plain text, including credentials. Replace with SFTP (port 22) or FTPS wherever possible. |
| **20** | TCP | FTP Data (Active) | FTP active mode data transfer. Problematic with firewalls and NAT; passive mode (random high port) is preferred. |
| **989** | TCP | FTPS Data | FTP data channel over TLS (explicit or implicit). |
| **990** | TCP | FTPS Control | FTP control channel over implicit TLS. More secure than standard FTP. |
| **2049** | TCP/UDP | NFS | Network File System — Unix/Linux file sharing protocol. Version 4 uses TCP only and is preferred. Restrict to trusted network segments. |
***
## VPN Ports
| Port | Protocol | Service | Description |
| --------- | -------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **500** | UDP | IKE / IPSec | Internet Key Exchange — used to establish IPSec VPN tunnels. Required on both the VPN server and client side. |
| **4500** | UDP | IPSec NAT-T | IPSec NAT Traversal — allows IPSec to traverse NAT devices. Used alongside port 500 when clients are behind NAT. Required for most IKEv2 and L2TP/IPSec VPN clients. |
| **1194** | UDP/TCP | OpenVPN | OpenVPN's default port. UDP is preferred for performance; TCP port 1194 or 443 is used when UDP is blocked or to blend with HTTPS traffic. |
| **1723** | TCP | PPTP | Point-to-Point Tunnelling Protocol. **Deprecated** — known security vulnerabilities. Do not use PPTP in new deployments; replace with IKEv2/IPSec or OpenVPN. |
| **1701** | UDP | L2TP | Layer 2 Tunnelling Protocol — used with IPSec for L2TP/IPSec VPNs. The combination is secure; L2TP alone provides no encryption. |
| **443** | TCP | SSL VPN | Many modern SSL/TLS-based VPN solutions (Cisco AnyConnect, GlobalProtect, OpenVPN TCP mode) use port 443 to blend with regular HTTPS traffic and avoid firewall blocks. |
| **51820** | UDP | WireGuard | WireGuard VPN protocol — default port. WireGuard is a modern, high-performance VPN protocol increasingly adopted as an alternative to OpenVPN and IPSec. |
***
## Other Common Ports
| Port | Protocol | Service | Description |
| ----------- | -------- | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **53** | TCP/UDP | DNS | Domain Name System — name resolution. UDP for standard queries; TCP for large responses and zone transfers. Block TCP/53 zone transfers from unauthorised hosts. |
| **67/68** | UDP | DHCP | Dynamic Host Configuration Protocol — 67 (server to client broadcast), 68 (client to server). Required between DHCP clients, relay agents, and servers. |
| **123** | UDP | NTP | Network Time Protocol — time synchronisation. Required for Kerberos authentication (clocks must be within 5 minutes). Windows domain members use the domain hierarchy for NTP. |
| **161/162** | UDP | SNMP | Simple Network Management Protocol — 161 for polling managed devices, 162 for traps (alerts from devices to the management station). Use SNMPv3 with authentication and encryption. |
| **514** | UDP | Syslog | Remote logging — devices send log messages to a centralised syslog server. Use TCP/514 or TLS syslog (6514) for reliable and encrypted log delivery. |
| **3306** | TCP | MySQL/MariaDB | MySQL and MariaDB database server. Restrict to localhost or application server IPs — never expose to the internet. |
| **5432** | TCP | PostgreSQL | PostgreSQL database server. Same security guidance as MySQL. |
| **1433** | TCP | MS SQL Server | Microsoft SQL Server database. Restrict access to application servers and DBA workstations via firewall rules. |
Use `netstat -ano` (Windows) or `ss -tulnp` (Linux) to see which ports are currently open and listening on a system. Cross-reference against this table to identify any unexpected services.