Open ports: which ones should never face the internet

Published October 27, 2026

A port is a numbered door on a server, and a service listens behind it. An open port is one that answers connections from the network. Some doors have to be open: your website, and your mail server if you run one. Many others should never be reachable by the whole internet, because they give strangers a place to guess passwords or use known flaws.

Ports that should rarely or never be public

• Remote Desktop (3389). A frequent target for password guessing and a common way into networks for ransomware. Put it behind a VPN or a gateway that requires multi-factor authentication.
• File sharing, SMB (445 and 139). Meant for the local network only. Block it at the firewall.
• Telnet (23). Sends everything, passwords included, unencrypted. Replace it with SSH.
• Databases such as MySQL (3306), PostgreSQL (5432), SQL Server (1433), MongoDB (27017), Redis (6379) and Elasticsearch (9200). They should be reachable only from the servers that use them.
• SSH (22). Fine when you need it, but limit it to known addresses, use keys instead of passwords and turn off password sign-in.
• FTP (21). Unencrypted. Use SFTP instead.
• VNC (5900) and other remote control tools. Treat them like Remote Desktop.
• Admin pages for routers, cameras, printers and other devices, often on ports such as 8080 or 8443. They should be reachable only from inside the network.

Ports that are normally fine

Web traffic on 80 and 443 is expected on a public website, and port 80 should only redirect visitors to 443. Mail ports (25, 465, 587, 993) are normal if you run your own mail server, but unusual if your mail is hosted by someone else, so ask why they are open.

An open port is exposure, not proof of a flaw

Seeing a port open does not mean the service behind it is vulnerable. It means a stranger can reach it, and the risk depends on what is running, which version it is and how well it is protected. The goal is to expose only what has to be public, and to keep that software updated.

How to find out what is open

You need to look from outside your network, because tools on your own computer show what is open locally, not what the internet can reach. The firewall rules, or the security groups if you use a cloud provider, are the real source of truth, so review them as well. An outside scan of your own domains and address ranges shows what a stranger would see.

How to close or protect a port

1. Decide whether the service needs to be reachable from the internet at all. If not, block it at the firewall.
2. If it does, restrict it to the addresses that need it, or put it behind a VPN.
3. Require multi-factor authentication on anything that lets a person sign in remotely.
4. Keep the software updated, and turn off any service nobody uses.
5. Scan again to confirm the port is really closed.

How Frontage helps

Frontage runs port checks on the domains you have authorized, lists exposed services by severity, and shows when a new one appears. A remote access port that opens up overnight is the kind of change monitoring exists to catch.