Skip to content
ProtocolPorts

Port reference

Port 1099 (TCP) – Java RMI Registry

Java Remote Method Invocation registry — name service that binds remote Java objects for client lookup.

tcpRegistered

Quick facts

Transport
tcp
Category
Registered
Risk level
High

Frequently targeted — restrict exposure and harden it.

Default state

Open on Java applications and middleware (app servers, JMX agents) exposing RMI endpoints, frequently without authentication.

What is port 1099 used for?

Port 1099 is the default for the Java RMI Registry, a name service in Java's Remote Method Invocation framework. The registry lets clients look up remote Java objects by name and obtain stubs that forward method calls to a server JVM. It's used by distributed Java applications and middleware, and is commonly reached through JMX for remote monitoring and management of application servers.

When would you open it?

You'd open port 1099 only if you run a Java application or app server that exposes RMI or JMX endpoints to other machines, for example to connect a monitoring tool to a remote JVM. If your Java services talk only on the same host, there's no need to expose this port at all.

Is it safe to open?

The main risk is that RMI/JMX endpoints are often left without authentication, so require credentials and TLS, keep the registry on a private network, and reach it over a VPN. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :1099
nmap -p 1099 <target>
Windows
netstat -ano | findstr :1099
Test-NetConnection <host> -Port 1099
macOS
lsof -i :1099
nmap -p 1099 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 1099 to your device's local IP, internal port 1099, protocol TCP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 1099/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=1099/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 1099 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 1099" -Direction Inbound -Protocol TCP -LocalPort 1099 -Action Allow

Security & risks

Common attacks

  • Insecure deserialization RCE via gadget chains (ysoserial)
  • Registry enumeration and remote object dumping
  • JMX/RMI exploitation for remote code execution
  • Codebase/classloader abuse to load attacker classes

Hardening

  • Do not expose RMI/JMX to untrusted networks
  • Require authentication and TLS on JMX/RMI endpoints
  • Patch the JVM and apply deserialization allowlists/filters
  • Disable remote codebase loading (java.rmi.server.useCodebaseOnly=true)
  • Firewall 1099 and the dynamic RMI object ports

How to block this port

Linux (ufw)
sudo ufw deny 1099/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=1099/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 1099 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 1099" -Direction Inbound -Protocol TCP -LocalPort 1099 -Action Block

nmap snippet

nmap -p1099 --script rmi-dumpregistry,rmi-vuln-classloader <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 1098Port 8686Port 9999Port 7001

Frequently asked questions

Why is the RMI registry on port 1099 risky?
RMI deserializes attacker-controlled objects. With a vulnerable gadget on the classpath, a single crafted call yields remote code execution, often with no authentication.
Is port 1099 related to JMX?
Yes. JMX commonly uses RMI for remote management, with the registry on 1099. Exposed JMX/RMI is a well-known path to deserialization RCE.

Related guides