How port numbers work
An IP address gets traffic to the right machine. A port number (0–65535) gets it to the right application on that machine. TCP and UDP each have their own set of 65,536 ports, so TCP 53 and UDP 53 are different doors. The Internet Assigned Numbers Authority (IANA) divides them into three ranges:
| Range | Name | Used for |
|---|---|---|
| 0 – 1023 | Well-known (system) ports | Core services: HTTP, SSH, DNS, SMTP. Binding usually needs admin/root rights |
| 1024 – 49151 | Registered ports | Specific applications: MySQL 3306, RDP 3389, PostgreSQL 5432 |
| 49152 – 65535 | Dynamic / ephemeral | Temporary client-side ports picked by the operating system |
Ports you should never expose to the internet
Automated scanners sweep the entire IPv4 internet in minutes, and exposed management and database ports are among the first things they find. Entries marked Don’t expose above should only be reachable over a VPN, a bastion host or an IP allow-list:
- RDP 3389, SMB 445, VNC 5900, Telnet 23: common ransomware entry points.
- Databases (3306, 5432, 1433, 27017, 6379, 9200): exposed databases cause many large data leaks.
- Docker 2375, Kubernetes 6443/10250, etcd 2379: exposure can hand over your whole infrastructure.
- UDP amplifiers (NTP 123, SSDP 1900, Memcached 11211, open DNS 53): abused to launch DDoS attacks on others.
Check what you expose: scan your own public IP with nmap from outside your network (you’re only allowed to scan systems you own or are authorised to test), or look yourself up on Shodan or Censys. Close anything you don’t recognise.
Protocols without ports
Some protocols sit directly on IP and are identified by a protocol number instead of a port. That’s why “allow OSPF” or “allow GRE” rules are written differently from port rules. OSPF (89), EIGRP (88), GRE (47), ESP (50) and VRRP (112) are the usual suspects when a routing adjacency or VPN tunnel won’t come up through a firewall.