Port reference
Port 1521 (TCP) – Oracle Database TNS Listener
Default Oracle TNS listener port for client connections to Oracle databases.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
The TNS listener binds to 1521 on Oracle Database hosts by default. Often reachable across the LAN; legacy or unpatched listeners may allow unauthenticated administration.
What is port 1521 used for?
Port 1521 is the default for the Oracle Database TNS listener, the process that accepts client connections and routes them to Oracle Database instances. Applications and tools such as SQL*Plus, SQL Developer, and JDBC/ODBC drivers connect here, identifying the target by SID or service name. It's the main entry point for connecting to an Oracle database.
When would you open it?
Open or forward 1521 only if you run an Oracle Database that other machines need to reach, such as an application server talking to a dedicated database host. If the database and its clients share one machine, you can keep connections local and leave the port closed to the network.
Is it safe to open?
An open Oracle listener is a high-value target for credential guessing and SID enumeration, so keep 1521 on a private network or VPN, set a listener password, and require encrypted connections. See the security notes below.
How to check if this port is open
ss -tulpn | grep :1521
nmap -p 1521 <target>netstat -ano | findstr :1521
Test-NetConnection <host> -Port 1521lsof -i :1521
nmap -p 1521 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 1521 to your device's local IP, internal port 1521, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 1521/tcpsudo firewall-cmd --permanent --add-port=1521/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 1521 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 1521" -Direction Inbound -Protocol TCP -LocalPort 1521 -Action AllowSecurity & risks
Common attacks
- SID and service-name brute force to discover databases
- TNS poisoning / listener registration hijacking
- Credential brute force against database accounts
- Exploitation of unauthenticated listener administration on old versions
Hardening
- Bind to a private interface; never expose 1521 to the internet
- Set a listener password and enable valid-node checking (ACLs)
- Apply the TNS poisoning fix (dynamic registration restrictions, CVE-2012-1675)
- Enforce strong DB account passwords and account lockout
- Require Oracle Native Network Encryption or TLS and patch promptly
How to block this port
sudo ufw deny 1521/tcpsudo firewall-cmd --permanent --remove-port=1521/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 1521 -j DROPNew-NetFirewallRule -DisplayName "Block 1521" -Direction Inbound -Protocol TCP -LocalPort 1521 -Action Blocknmap snippet
nmap -p1521 --script oracle-tns-version,oracle-sid-brute <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is TNS poisoning?
- A flaw (CVE-2012-1675) where an attacker registers a rogue service with the listener and intercepts or hijacks client traffic. Restrict dynamic registration and apply Oracle's mitigation.
- Why brute-force the Oracle SID?
- You must know a valid SID or service name to connect. Discovering it via brute force is the first step before attacking database credentials, so a private listener limits exposure.