Port reference
Port 2181 (TCP) – Apache ZooKeeper
Default client port for Apache ZooKeeper, a distributed coordination and configuration service.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
ZooKeeper historically binds to all interfaces with no authentication and four-letter-word admin commands enabled, so any client reaching 2181 can read or modify the znode tree.
What is port 2181 used for?
Port 2181 is the default client port for Apache ZooKeeper, a distributed coordination service that stores configuration, naming, and synchronization data in a tree of "znodes". Big-data and messaging systems such as Apache Kafka, HBase, Hadoop, and Solr connect to it to elect leaders and keep track of cluster state. Clients and applications use 2181 to read and write this shared metadata.
When would you open it?
You open 2181 when you run a ZooKeeper ensemble and need its client applications (for example Kafka brokers or your own services) to reach it. Typically you allow it only within your private cluster network so the nodes that depend on ZooKeeper can connect.
Is it safe to open?
ZooKeeper ships with no authentication by default, so an exposed port lets anyone read or change cluster data. Keep it on a private network, turn on SASL/Kerberos authentication and znode ACLs, and restrict access by firewall. See the security notes below.
How to check if this port is open
ss -tulpn | grep :2181
nmap -p 2181 <target>netstat -ano | findstr :2181
Test-NetConnection <host> -Port 2181lsof -i :2181
nmap -p 2181 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 2181 to your device's local IP, internal port 2181, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 2181/tcpsudo firewall-cmd --permanent --add-port=2181/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 2181 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 2181" -Direction Inbound -Protocol TCP -LocalPort 2181 -Action AllowSecurity & risks
Common attacks
- Unauthenticated 'four-letter words' (mntr, stat, conf, envi) leaking config and topology
- Reading and tampering with znodes to disrupt or hijack dependent clusters
- Information disclosure of broker, cluster, and service metadata
- Denial of service by deleting or corrupting coordination data
Hardening
- Bind to a private interface and firewall 2181 to trusted hosts only
- Enable authentication (SASL/Kerberos) and ACLs on znodes
- Restrict or disable the four-letter-word commands via 4lw.commands.whitelist
- Require TLS for client and quorum traffic
- Run as an unprivileged user and patch regularly
How to block this port
sudo ufw deny 2181/tcpsudo firewall-cmd --permanent --remove-port=2181/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 2181 -j DROPNew-NetFirewallRule -DisplayName "Block 2181" -Direction Inbound -Protocol TCP -LocalPort 2181 -Action Blocknmap snippet
nmap -p2181 --script zookeeper-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Are ZooKeeper's four-letter-word commands a security risk?
- Yes. Commands like mntr, stat, conf, and envi return cluster configuration and topology to any unauthenticated client. Restrict them with 4lw.commands.whitelist and firewall port 2181.
- Does ZooKeeper require authentication by default?
- No. By default any client reaching 2181 can read and modify znodes. Enable SASL/Kerberos authentication and set ACLs on znodes to protect the data tree.