An IP addressIP address The number address of a device on the internet, like 203.0.113.10. Computers use it to find each other, the way post uses street addresses. More about IP address → gets data to the right machine. A port numberPort A numbered door on a server. Each service listens behind its own door: web pages on 443, email on others, remote login on 22. More about Port → gets it to the right program on that machine. A single server can run a website, SSHSSH A secure way to type commands on a server from your own computer, as if you were sitting at it. More about SSH → and a database at once, each listening on its own port.
A port number identifies which program on a server should receive a connection. The IP address gets traffic to the right machine; the port gets it to the right service on that machine, such as 443 for HTTPSHTTPS The secure version of the web, shown by the padlock. Everything sent between you and the site is scrambled so nobody in between can read or change it. More about HTTPS → or 22 for SSH.
Think of the IP address as a building’s street address and the port as the flat number. One server can run a website, SSH, a database and email at the same time because each listens on its own port.
Common ports
| Port | Used by |
|---|---|
| 22 | SSH and SFTP |
| 25 | Email between mail servers (SMTP) |
| 53 | DNS |
| 80 | HTTP |
| 443 | HTTPS |
| 465, 587 | Email sent from mail apps (SMTP submission) |
| 993 | IMAP over TLS (reading email) |
| 3306 | MySQL and MariaDB |
| 5432 | PostgreSQL |
| 6379 | Redis |
Ports run from 0 to 65535. Browsers assume port 80 for http:// and 443 for https://, which is why you rarely see them in addresses. You can name a port explicitly: http://example.com:8080.
TCP and UDP
Each port number exists twice: once for TCP and once for UDP. TCP sets up a connection and guarantees data arrives complete and in order, which suits web pages, SSH and email. UDP sends without a connection or guarantees, which suits DNSDNS The internet’s phone book. It turns a name people can remember, like example.com, into the number address computers use to find the server. More about DNS → lookups, video calls and games, where speed matters more than the odd lost packet. HTTP/3 also runs over UDP. Firewall rules name the protocol: 443/tcp and 443/udp are separate.
Ranges
| Range | Name | Used for |
|---|---|---|
| 0 to 1023 | Well-known ports | Standard services; only root can listen on them |
| 1024 to 49151 | Registered ports | Specific applications, such as 3306 for MySQL |
| 49152 to 65535 | Dynamic ports | Temporary ports your computer uses for its side of outgoing connections |
When your browser connects to a server’s port 443, your own computer uses a random dynamic port for its end. That is why firewallsFirewall A gatekeeper that decides which connections are allowed into a server and blocks the rest. More about Firewall → normally allow outgoing traffic and only restrict incoming.
Listening and open
A program listens on a port. A firewall decides whether outsiders may reach it. A database listening on 3306 should usually be reachable only from the server itself, not from the internet.
See what is listening
On a Linux server:
sudo ss -tlnpThis lists TCP ports that programs are listening on, with the program names. An address of 127.0.0.1 means local only; 0.0.0.0 or * means every network.
Changing a service’s port
Most services let you choose their port. Moving SSH from 22 to another number cuts down log noise from bots, though it is not real security on its own; SSH keys are. If you change a port, update the firewall first, and on AlmaLinux, Rocky and RHEL, tell SELinux too.
App servers such as Node.js often listen on ports like 3000 or 8080 because ports below 1024 need root. In production, put NginxNginx A fast, popular program that sends web pages to visitors and can pass requests on to apps behind it. More about Nginx → in front on 80 and 443 as a reverse proxy, rather than exposing the app’s port.
Test from outside
nc -zv 203.0.113.10 443succeeded means the port is reachable. A timeout usually means a firewall; refused means nothing is listening. See ERR_CONNECTION_REFUSED.
Related
Something out of date? Software changes. If a step no longer works, tell us and we will check it and update the page.
