Port reference
Port 23 (TCP) – Telnet
Unencrypted remote terminal protocol for interactive login and device management.
Quick facts
- Transport
- tcp
- Category
- Well-known
- TLS
- Cleartext
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Disabled on modern OSes but still enabled by default on many routers, switches, IoT, and industrial devices.
What is port 23 used for?
Port 23 is the default port for Telnet, one of the oldest protocols for an
interactive command-line session on a remote machine. It is handled by the
classic telnet client found on most systems and by terminal apps like PuTTY.
Modern operating systems have dropped it in favor of SSH, but it is still enabled
on many older routers, switches, IoT gadgets, and industrial equipment for
configuration and management.
When would you open it?
You would only open port 23 to reach a legacy device that offers nothing but Telnet, such as an old switch, console server, or industrial controller. Use it strictly on a trusted local network for that one device, and only if you actually run a Telnet service that has no SSH alternative.
Is it safe to open?
Telnet sends everything, including passwords, in plain text, so the safe approach is to avoid it entirely, prefer SSH, and keep any unavoidable Telnet on an isolated private network. See the security notes below.
How to check if this port is open
ss -tulpn | grep :23
nmap -p 23 <target>netstat -ano | findstr :23
Test-NetConnection <host> -Port 23lsof -i :23
nmap -p 23 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 23 to your device's local IP, internal port 23, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 23/tcpsudo firewall-cmd --permanent --add-port=23/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 23 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 23" -Direction Inbound -Protocol TCP -LocalPort 23 -Action AllowSecurity & risks
Use a secure alternative
This is a legacy or cleartext protocol. Prefer the encrypted equivalent:
Common attacks
- Cleartext credential capture via sniffing
- Default and weak credentials on routers and IoT
- Mass botnet infection (Mirai-style) of exposed devices
- Credential brute force and password spraying
Hardening
- Disable Telnet entirely and use SSH (port 22) instead
- If unavoidable, restrict to an isolated management VLAN, never the internet
- Change all default credentials and enforce strong passwords
- Block port 23 inbound at the perimeter firewall
How to block this port
sudo ufw deny 23/tcpsudo firewall-cmd --permanent --remove-port=23/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 23 -j DROPNew-NetFirewallRule -DisplayName "Block 23" -Direction Inbound -Protocol TCP -LocalPort 23 -Action Blocknmap snippet
nmap -p23 --script telnet-encryption,telnet-ntlm-info,banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is port 23 dangerous?
- Yes. Telnet sends everything, including passwords, in cleartext and has no encryption. Anyone on the path can read credentials, and exposed devices are mass-targeted by botnets. Use SSH instead.
- Why is Telnet still used?
- Legacy routers, switches, IoT, and industrial gear often ship with Telnet enabled for convenience. It should be disabled in favor of SSH wherever possible.