Port reference
Port 135 (TCP) – MSRPC Endpoint Mapper
Microsoft RPC endpoint mapper — directs clients to dynamic RPC service ports on Windows.
Quick facts
- Transport
- tcp
- Category
- Well-known
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on virtually all Windows hosts and domain controllers. Should be firewalled from untrusted networks.
What is port 135 used for?
Port 135 is the Microsoft RPC (MSRPC) endpoint mapper, a built-in Windows service that acts as a switchboard. When a client wants to use a Windows RPC feature — DCOM, WMI (used for remote management and tools like PsExec), the task scheduler, the print spooler, or Active Directory replication — it first asks port 135 which dynamic port that service is on, then connects there. It runs on practically every Windows machine and domain controller.
When would you open it?
Port 135 needs to be reachable for Windows-to-Windows management and RPC features across a network — remote WMI, certain administrative tools, and domain communication. Open it only within a trusted internal/management network, never to the internet or untrusted client subnets.
Is it safe to open?
It exposes the list of RPC services and is a known foothold for authentication-relay attacks, so firewall it to trusted networks, keep Windows patched, and enforce SMB signing. See the security notes below.
How to check if this port is open
ss -tulpn | grep :135
nmap -p 135 <target>netstat -ano | findstr :135
Test-NetConnection <host> -Port 135lsof -i :135
nmap -p 135 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 135 to your device's local IP, internal port 135, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 135/tcpsudo firewall-cmd --permanent --add-port=135/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 135 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 135" -Direction Inbound -Protocol TCP -LocalPort 135 -Action AllowSecurity & risks
Common attacks
- Endpoint mapper enumeration of RPC services
- PetitPotam / authentication coercion via MS-EFSRPC
- DCOM-based NTLM relay vectors
- Remote service and task enumeration
Hardening
- Block 135 and the dynamic RPC range from untrusted networks
- Patch coercion vulnerabilities (PetitPotam, PrinterBug)
- Enforce SMB signing and LDAP channel binding to break relays
- Disable unneeded RPC services (Spooler on DCs)
- Restrict the dynamic RPC port range and firewall it
How to block this port
sudo ufw deny 135/tcpsudo firewall-cmd --permanent --remove-port=135/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 135 -j DROPNew-NetFirewallRule -DisplayName "Block 135" -Direction Inbound -Protocol TCP -LocalPort 135 -Action Blocknmap snippet
nmap -p135 --script msrpc-enum <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 135 used for?
- Port 135 is the Microsoft RPC endpoint mapper. Clients query it to discover which dynamic port a given RPC service (DCOM, WMI, scheduled tasks, etc.) is listening on.
- Why is port 135 a security risk?
- It exposes the RPC service landscape for enumeration and is the entry point for authentication-coercion attacks like PetitPotam that force a host to relay its credentials.