Port reference
Port 20000 (TCP) – DNP3
Distributed Network Protocol 3 — polls and commands RTUs and IEDs in electric, water, and utility SCADA.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on DNP3 outstations (RTUs/IEDs) and masters in utility SCADA, with no authentication on the base protocol.
What is port 20000 used for?
Port 20000 carries DNP3 (Distributed Network Protocol 3), a SCADA protocol widely used by electric, water, and wastewater utilities in North America. A control-room master polls field devices — remote terminal units (RTUs) and intelligent electronic devices (IEDs) — to read measurements and send commands such as operating breakers or pumps. It is found in SCADA software from vendors like SEL, GE, and Schneider Electric.
When would you open it?
This port belongs on isolated industrial control (OT) networks where a SCADA master communicates with utility field equipment. Open it only between the specific controllers and outstations that need to talk, behind a firewall. It should never be reachable from the internet or an office network.
Is it safe to open?
Standard DNP3 has no authentication, so anyone who can reach the port could read or command equipment; keep it segmented on a dedicated OT network. See the security notes below.
How to check if this port is open
ss -tulpn | grep :20000
nmap -p 20000 <target>netstat -ano | findstr :20000
Test-NetConnection <host> -Port 20000lsof -i :20000
nmap -p 20000 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 20000 to your device's local IP, internal port 20000, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 20000/tcpsudo firewall-cmd --permanent --add-port=20000/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 20000 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 20000" -Direction Inbound -Protocol TCP -LocalPort 20000 -Action AllowSecurity & risks
Common attacks
- Unauthenticated reads of points and unauthorized control commands
- Outstation enumeration and address discovery via dnp3-info
- Spoofing/replay of DNP3 application messages
- Denial of service against RTUs and IEDs
Hardening
- Never expose port 20000 to the internet — isolate DNP3 on an OT network
- Segment with firewalls/DMZ and allowlist authorized masters
- Enable DNP3 Secure Authentication (IEEE 1815) where supported
- Monitor with an ICS IDS for unexpected control function codes
How to block this port
sudo ufw deny 20000/tcpsudo firewall-cmd --permanent --remove-port=20000/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 20000 -j DROPNew-NetFirewallRule -DisplayName "Block 20000" -Direction Inbound -Protocol TCP -LocalPort 20000 -Action Blocknmap snippet
nmap -p20000 --script dnp3-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Does DNP3 have authentication?
- The base DNP3 protocol has no authentication, so any host reaching port 20000 can read points and issue control commands. IEEE 1815 adds optional Secure Authentication, but many deployments do not enable it.
- How is DNP3 different from Modbus?
- Both are SCADA protocols with no inherent security, but DNP3 is richer — it supports timestamps, event buffering, and unsolicited reporting — and dominates electric and water utilities, whereas Modbus is common in general industry.