Port reference
Port 2379 (TCP) – etcd Client API
Default client API port for etcd, the distributed key-value store behind Kubernetes.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
etcd can be configured to listen on 0.0.0.0:2379 without client certificate authentication. Misconfigured clusters expose the entire key-value store, including every Kubernetes secret, to anyone who can reach the port.
What is port 2379 used for?
Port 2379 is the default client API port for etcd, the distributed key-value store that backs Kubernetes and other clustered systems. The Kubernetes API server and other clients read and write cluster state over 2379, while etcd members sync with each other over port 2380. etcd holds the authoritative copy of everything the cluster knows, including its configuration and secrets.
When would you open it?
You open 2379 so the Kubernetes API server and etcd clients can reach the store. In practice it is kept on a private control-plane network, opened only between the API server and the etcd nodes rather than to general users or the internet.
Is it safe to open?
etcd can listen without authentication, and exposing 2379 lets anyone read every Kubernetes secret — effectively full cluster takeover. Bind it to a private interface, require mutual TLS with client certificates, and firewall it to the control plane only. See the security notes below.
How to check if this port is open
ss -tulpn | grep :2379
nmap -p 2379 <target>netstat -ano | findstr :2379
Test-NetConnection <host> -Port 2379lsof -i :2379
nmap -p 2379 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 2379 to your device's local IP, internal port 2379, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 2379/tcpsudo firewall-cmd --permanent --add-port=2379/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 2379 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 2379" -Direction Inbound -Protocol TCP -LocalPort 2379 -Action AllowSecurity & risks
Common attacks
- Unauthenticated reads that dump all Kubernetes secrets and cluster state
- Full cluster compromise by extracting service-account tokens and credentials
- Tampering with cluster state by writing arbitrary keys
- Information disclosure of configmaps, certificates, and topology
Hardening
- Bind to localhost or a private interface; never expose 2379 to the internet
- Require client and peer certificate authentication (mutual TLS)
- Enable RBAC and encryption-at-rest for etcd data
- Firewall 2379 to control-plane nodes and the Kubernetes API server (6443) only
- Keep etcd patched and audit access
How to block this port
sudo ufw deny 2379/tcpsudo firewall-cmd --permanent --remove-port=2379/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 2379 -j DROPNew-NetFirewallRule -DisplayName "Block 2379" -Direction Inbound -Protocol TCP -LocalPort 2379 -Action Blocknmap snippet
nmap -p2379 --script http-title <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Why is an exposed etcd port so dangerous?
- etcd stores all Kubernetes state, including every secret and service-account token. Unauthenticated read access to 2379 means full cluster compromise: an attacker can dump credentials and take over the Kubernetes API on 6443.
- How should etcd be protected?
- Bind to a private interface, require mutual TLS with client certificates, enable RBAC and encryption-at-rest, and firewall 2379 so only control-plane nodes and the API server can reach it.