Common Ports
Quick answer: port numbers run 0–65535 in three ranges: 0–1023 are well-known (assigned by IANA, usually needing admin privileges to bind), 1024–49151 are registered, and 49152–65535 are dynamic/ephemeral — the range your OS picks for outbound connections.
Web and remote access
| 22 | SSHtcp | Encrypted shell and file transfer. Never expose password login to the internet; use keys. |
| 53 | DNStcp/udp | Name resolution. Open resolvers get abused for amplification attacks. |
| 80 | HTTPtcp | Plaintext web. Fine behind a redirect to 443; never serve logins here. |
| 443 | HTTPStcp | TLS-encrypted web. The default for anything user-facing. |
| 8080 | HTTP alternatetcp | Common for dev servers and proxies. Easy to forget open in production. |
| 25 | SMTPtcp | Server-to-server mail relay. An open relay will be found and abused within hours. |
| 465 | SMTPStcp | Mail submission over implicit TLS. |
| 587 | SMTP submissiontcp | Authenticated client submission with STARTTLS. |
| 993 | IMAPStcp | Mailbox sync over TLS. |
| 995 | POP3Stcp | Mail download over TLS. |
Databases and caches
| 1433 | SQL Servertcp | Bind to private networks only; a favorite ransomware target. |
| 1521 | Oracletcp | Bind to private networks only. |
| 3306 | MySQL / MariaDBtcp | Never expose to the internet; use a VPN or SSH tunnel instead. |
| 5432 | PostgreSQLtcp | Same rule: private network or tunnel only. |
| 6379 | Redistcp | No built-in auth by default. Publicly exposed Redis instances get hijacked routinely. |
| 27017 | MongoDBtcp | Older versions defaulted to no auth; always require credentials and bind privately. |
Messaging and infra
| 5672 | AMQP (RabbitMQ)tcp | Message broker. 15672 is its management UI — restrict both. |
| 9092 | Kafkatcp | Event streaming. 9093 is the TLS variant. |
| 2375 | Docker (plain)tcp | Unauthenticated Docker API. If this is open to the network, the host is owned. Use 2376 with TLS. |
| 6443 | Kubernetes APItcp | Cluster control plane. Restrict to admin networks. |
| 9200 | Elasticsearchtcp | Search API. Exposed instances leak entire datasets; bind privately. |
File transfer and legacy
| 20/21 | FTPtcp | Plaintext credentials and data. Prefer SFTP (over SSH) or HTTPS. |
| 69 | TFTPudp | No auth at all. LAN provisioning only. |
| 139/445 | SMBtcp | Windows file sharing. The vector behind WannaCry; block at the perimeter. |
| 3389 | RDPtcp | Remote desktop. Brute-forced constantly; put it behind a VPN or gateway. |
Working with port ranges and firewalls
Firewall rules and security groups are usually expressed in CIDR blocks plus port ranges. If you need to check which addresses a rule covers, the CIDR calculator expands a block into its network, broadcast, and host range, and the IP range calculator converts an explicit start–end range into minimal CIDR blocks.