Skip to content
ProtocolPorts

Port reference

Port 10250 (TCP) – Kubernetes kubelet API

HTTPS API on each Kubernetes node's kubelet for pod lifecycle, logs, exec, and metrics.

tcpRegistered

Quick facts

Transport
tcp
Category
Registered
Risk level
High

Frequently targeted — restrict exposure and harden it.

Default state

Open on every node running a kubelet. Hardened clusters require authentication; misconfigured ones allow anonymous access to exec and run commands.

What is port 10250 used for?

Port 10250 is the Kubernetes kubelet API, served over HTTPS on every node in the cluster. The kubelet is the agent that runs containers on each node, and the control plane and Kubernetes API server (6443) use this port to manage pod lifecycle, stream logs, gather metrics, and exec commands inside running containers. Monitoring tools like metrics-server also scrape it. It is one of the most powerful endpoints on a node.

When would you open it?

You generally do not open 10250 yourself; it is part of normal cluster operation between the control plane and nodes. You allow it through firewalls and network policies only between the control plane and worker nodes, and for trusted metrics scrapers. It should never face the public internet.

Is it safe to open?

A misconfigured kubelet that allows anonymous access turns 10250 into unauthenticated remote code execution on your containers and nodes. Disable anonymous auth, enable Webhook authorization, and keep the port private to the cluster. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :10250
nmap -p 10250 <target>
Windows
netstat -ano | findstr :10250
Test-NetConnection <host> -Port 10250
macOS
lsof -i :10250
nmap -p 10250 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 10250 to your device's local IP, internal port 10250, protocol TCP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 10250/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=10250/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 10250 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 10250" -Direction Inbound -Protocol TCP -LocalPort 10250 -Action Allow

Security & risks

Common attacks

  • Anonymous access to /exec and /run for container and node RCE
  • Listing pods and reading logs to harvest secrets and tokens
  • Pivoting from a compromised node to the API server on 6443
  • Lateral movement across workloads via service account tokens

Hardening

  • Disable kubelet anonymous auth (--anonymous-auth=false)
  • Enable Webhook authorization (--authorization-mode=Webhook)
  • Never expose 10250 to the internet; restrict to the control plane
  • Use NetworkPolicies and firewall node ports
  • Rotate credentials and keep Kubernetes patched

How to block this port

Linux (ufw)
sudo ufw deny 10250/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=10250/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 10250 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 10250" -Direction Inbound -Protocol TCP -LocalPort 10250 -Action Block

nmap snippet

nmap -p10250 --script ssl-cert,http-title <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 6443Port 10255Port 2379Port 8443

Frequently asked questions

What is port 10250 used for?
It is the Kubernetes kubelet API, served over HTTPS on every node. The control plane uses it to manage pods, stream logs, and exec into containers. It is one of the most sensitive endpoints on a node.
Why is an exposed kubelet on 10250 dangerous?
If anonymous auth is enabled, anyone reaching 10250 can call /exec and /run to execute commands in containers and on the node, then pivot to the API server on 6443. Disable anonymous auth, enforce Webhook authorization, and keep 10250 private.

Related guides