Port reference
Port 1080 (TCP) – SOCKS Proxy
SOCKS proxy — a generic TCP/UDP relay used to tunnel and forward arbitrary traffic.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on hosts running a SOCKS proxy (Dante, SSH dynamic forwarding, malware implants). Not enabled by default on stock systems.
What is port 1080 used for?
Port 1080 is the traditional default for a SOCKS proxy, a general-purpose relay that forwards arbitrary TCP traffic (and UDP in SOCKS5) between a client and a destination. It's the port people use to tunnel or route their connections through another machine. You'll see it with SSH dynamic forwarding (ssh -D), Tor's local proxy, Shadowsocks, the Dante server, proxychains, and browsers configured to use a SOCKS proxy.
When would you open it?
You'd open or forward port 1080 only if you run a SOCKS proxy yourself, for example to give remote clients a relay, bounce traffic through a jump host, or reach an internal network. Most people simply point a client at an existing proxy and never need to expose the port publicly.
Is it safe to open?
The main risk is running an "open" proxy that anyone can use to relay traffic, so require authentication, keep it bound to localhost or your private network, and reach it over SSH or a VPN. See the security notes below.
How to check if this port is open
ss -tulpn | grep :1080
nmap -p 1080 <target>netstat -ano | findstr :1080
Test-NetConnection <host> -Port 1080lsof -i :1080
nmap -p 1080 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 1080 to your device's local IP, internal port 1080, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 1080/tcpsudo firewall-cmd --permanent --add-port=1080/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 1080 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 1080" -Direction Inbound -Protocol TCP -LocalPort 1080 -Action AllowSecurity & risks
Common attacks
- Open-proxy abuse — relaying spam, scanning and attack traffic
- Anonymization of malicious traffic to hide the true source
- Credential brute force against authenticated SOCKS proxies
- Use by malware/C2 for pivoting through compromised hosts
Hardening
- Never run an open SOCKS proxy — require authentication
- Bind to localhost/internal interfaces, not 0.0.0.0
- Restrict allowed destinations and source IPs
- Block inbound 1080 at the perimeter unless explicitly needed
- Monitor for unexpected SOCKS listeners — they can indicate compromise
How to block this port
sudo ufw deny 1080/tcpsudo firewall-cmd --permanent --remove-port=1080/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 1080 -j DROPNew-NetFirewallRule -DisplayName "Block 1080" -Direction Inbound -Protocol TCP -LocalPort 1080 -Action Blocknmap snippet
nmap -p1080 --script socks-open-proxy,socks-auth-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is a SOCKS proxy on port 1080?
- SOCKS is a protocol that relays arbitrary TCP (and UDP in SOCKS5) connections through an intermediary. Port 1080 is its traditional default, used for tunneling and traffic forwarding.
- Why are open SOCKS proxies dangerous?
- An open proxy lets anyone relay traffic through your host, laundering spam, scans and attacks so they appear to originate from you. It can also signal a malware foothold.