TCP/UDP Port Reference

The well-known ports for common services, in one place — for writing firewall rules, debugging why a connection is being refused, or working out at a glance what's actually running behind an unfamiliar open port.

The three port ranges

• Well-known (0–1023) — assigned by IANA to standard protocols: HTTP is 80, HTTPS is 443, SSH is 22
• Registered (1024–49151) — registered for specific applications: MySQL 3306, RDP 3389
• Dynamic/ephemeral (49152–65535) — used temporarily by clients for outbound connections, assigned automatically and not something you'd normally configure by hand

Least privilege, applied to ports specifically

Only open what genuinely needs to be reachable from where it's being opened to. The recurring mistakes: RDP (3389) exposed straight to the internet — a leading ransomware entry vector, not a hypothetical one — SSH left open without key-based auth, and database ports (3306, 5432, 27017) reachable from anywhere instead of being locked down to the application tier that actually needs them.

Ports worth treating with specific caution

• 22 (SSH) — a constant target for brute-force attempts. Key auth, source IP restriction, and moving off the default port all reduce the noise.
• 23 (Telnet) — unencrypted, full stop. No reason for this on a production system in 2026; SSH replaced it decades ago.
• 3389 (RDP) — never expose directly to the internet. VPN or a properly configured MFA gateway in front of it, no exceptions.
• 445 (SMB) — the EternalBlue/WannaCry vector. Block it at the perimeter and don't think twice about it.
• 3306 (MySQL) — application-tier only, never internet-facing, no matter how strong the password is.

Whether you're writing security group rules, docker-compose port mappings, or a firewall policy from scratch, the underlying question is always the same: does this actually need to be reachable from where it's currently reachable from, or is that just the default nobody's revisited.