Port reference
Port 111 (TCP/UDP) – RPCbind / Portmapper
ONC RPC portmapper — tells clients which ports dynamic RPC services (NFS, NIS, mountd) listen on.
Quick facts
- Transport
- tcp, udp
- Category
- Well-known
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on Linux/Unix and Solaris hosts running RPC-based services such as NFS or NIS, often left exposed by default with the rpcbind package.
What is port 111 used for?
Port 111 runs RPCbind, historically called the portmapper, on Linux, Unix, and Solaris systems. It's a directory: when a program like NFS (network file sharing), mountd, or NIS starts, it registers with rpcbind, and clients ask port 111 which dynamic port that service is actually listening on. It's a core piece of classic NFSv2/v3 file sharing and listens on both TCP and UDP.
When would you open it?
You only need port 111 reachable if a machine shares files over NFSv2/v3 (or runs NIS) and clients on your network mount those shares. If you've moved to NFSv4, you don't need rpcbind at all, since v4 uses a single fixed port (2049).
Is it safe to open?
Because rpcbind lists every RPC service on the host and can be abused for amplification attacks, never expose it to the internet — keep it on a trusted internal network or disable it if unused. See the security notes below.
How to check if this port is open
ss -tulpn | grep :111
nmap -p 111 <target>netstat -ano | findstr :111
Test-NetConnection <host> -Port 111lsof -i :111
nmap -p 111 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 111 to your device's local IP, internal port 111, protocol TCP/UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 111/tcpsudo firewall-cmd --permanent --add-port=111/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 111 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 111" -Direction Inbound -Protocol TCP -LocalPort 111 -Action AllowSecurity & risks
Common attacks
- RPC service enumeration to discover NFS, mountd, NIS and statd
- UDP amplification / reflection DDoS
- Pivot to NFS export access and NIS data exposure
- Exploitation of vulnerable RPC services advertised by the mapper
Hardening
- Do not expose 111 to the internet — block at the perimeter firewall
- Bind rpcbind to internal interfaces and restrict with tcp_wrappers / firewall rules
- Disable rpcbind entirely if no RPC services (NFS/NIS) are in use
- Use NFSv4 which does not require the portmapper
- Filter UDP/111 to prevent amplification reflection
How to block this port
sudo ufw deny 111/tcpsudo firewall-cmd --permanent --remove-port=111/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 111 -j DROPNew-NetFirewallRule -DisplayName "Block 111" -Direction Inbound -Protocol TCP -LocalPort 111 -Action Blocknmap snippet
nmap -p111 -sU -sT --script rpcinfo <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 111 used for?
- Port 111 runs RPCbind (the portmapper), which tells clients which dynamic ports RPC services like NFS, mountd and NIS are listening on. It is required by NFSv2/v3 but not NFSv4.
- Is port 111 a security risk?
- Yes when exposed. It leaks the full list of RPC services running on a host and can be abused for UDP amplification DDoS. It should never be reachable from the internet.