Port reference
Port 179 (TCP) – BGP
Border Gateway Protocol — the exterior routing protocol that exchanges reachability between autonomous systems.
Quick facts
- Transport
- tcp
- Category
- Well-known
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open between configured BGP peers (routers, route servers, IXP fabric). Should never be reachable from arbitrary internet hosts.
What is port 179 used for?
Port 179 is the TCP port for BGP (Border Gateway Protocol), the protocol that glues the internet together by exchanging routing information between networks, or autonomous systems. Two routers open a TCP/179 session, share which IP ranges they can reach, and keep each other updated as routes change. It runs on ISP edge routers, multihomed enterprise routers, route servers, and internet exchanges, configured in software like Cisco IOS, Juniper Junos, and FRRouting or BIRD.
When would you open it?
You'd allow port 179 only between specific, agreed-upon BGP peers — for example your border router and your ISP, or two routers in a multihomed setup. It should accept connections only from those configured peer IP addresses, never from the open internet.
Is it safe to open?
An exposed BGP listener invites spoofed peering, session resets, and route hijacking, so lock it to known peer IPs, authenticate sessions (TCP-MD5/TCP-AO), and filter routes with RPKI. See the security notes below.
How to check if this port is open
ss -tulpn | grep :179
nmap -p 179 <target>netstat -ano | findstr :179
Test-NetConnection <host> -Port 179lsof -i :179
nmap -p 179 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 179 to your device's local IP, internal port 179, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 179/tcpsudo firewall-cmd --permanent --add-port=179/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 179 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 179" -Direction Inbound -Protocol TCP -LocalPort 179 -Action AllowSecurity & risks
Common attacks
- Prefix / route hijacking (announcing routes you don't own)
- TCP RST session reset and session hijacking
- Spoofed or malformed UPDATE messages to flap or poison routes
- DoS against the BGP listener to drop peering sessions
Hardening
- Authenticate sessions with TCP-MD5 or TCP-AO between peers
- Enforce GTSM (TTL security / max-hop check) on the listener
- Filter prefixes with IRR-based prefix-lists and max-prefix limits
- Deploy RPKI Route Origin Validation to reject bogus origins
- ACL the port so only known peer IPs can reach TCP/179
How to block this port
sudo ufw deny 179/tcpsudo firewall-cmd --permanent --remove-port=179/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 179 -j DROPNew-NetFirewallRule -DisplayName "Block 179" -Direction Inbound -Protocol TCP -LocalPort 179 -Action Blocknmap snippet
nmap -p179 --script bgp-routing <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Should port 179 be exposed to the internet?
- No. BGP should only accept connections from explicitly configured peer addresses. Restrict TCP/179 with ACLs and authenticate sessions; an open listener invites spoofed peering and DoS.
- What stops BGP route hijacking?
- RPKI Route Origin Validation, strict IRR-based prefix filtering, and max-prefix limits reject announcements from networks that aren't authorized to originate a prefix.