Port reference
Port 3000 (TCP) – Dev Server / Grafana
Common dev-server port (Node.js, Create React App, Rails) and the default for Grafana. No single fixed service.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Open when a dev server or Grafana is running. Frequently plain HTTP and exposed to all interfaces by mistake.
What is port 3000 used for?
Port 3000 is the go-to port for local web development. It is the default for many Node.js apps, Create React App, Next.js, and Ruby on Rails dev servers, so it is what you typically see at http://localhost:3000 while building a site. It is also the default web port for Grafana, the popular metrics and dashboard tool. There is no single fixed service on 3000 — it depends on what you are running.
When would you open it?
During development you reach 3000 on your own machine and rarely need to open it to others. You would forward or open it only to share a work-in-progress app on your network, or to expose a real service like Grafana — and even then usually behind a reverse proxy.
Is it safe to open?
Dev servers and tools like Grafana on 3000 often run plain HTTP with weak or default logins, so exposing them publicly is risky. Keep it bound to localhost or behind an authenticated HTTPS reverse proxy or VPN. See the security notes below.
How to check if this port is open
ss -tulpn | grep :3000
nmap -p 3000 <target>netstat -ano | findstr :3000
Test-NetConnection <host> -Port 3000lsof -i :3000
nmap -p 3000 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 3000 to your device's local IP, internal port 3000, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 3000/tcpsudo firewall-cmd --permanent --add-port=3000/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 3000 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 3000" -Direction Inbound -Protocol TCP -LocalPort 3000 -Action AllowSecurity & risks
Common attacks
- Grafana path traversal / arbitrary file read (CVE-2021-43798)
- Default or weak Grafana admin credentials (admin/admin)
- Accidentally exposed Node/Rails dev servers with debug output
- Cleartext interception of credentials and session tokens
Hardening
- Patch Grafana to a fixed release (CVE-2021-43798 affected 8.0.0–8.3.0)
- Change default admin credentials and enforce strong auth/MFA
- Never expose dev servers or Grafana on 3000 directly to the internet
- Bind to localhost and front with an authenticated TLS reverse proxy
- Restrict by IP allowlist / VPN and disable framework debug mode
How to block this port
sudo ufw deny 3000/tcpsudo firewall-cmd --permanent --remove-port=3000/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 3000 -j DROPNew-NetFirewallRule -DisplayName "Block 3000" -Direction Inbound -Protocol TCP -LocalPort 3000 -Action Blocknmap snippet
nmap -p3000 --script http-title,http-headers,http-enum <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 3000 used for?
- It is a common development-server port (Node.js, Create React App, Ruby on Rails) and the default for Grafana. There is no single fixed service, so fingerprint what is actually listening before drawing conclusions.
- What is CVE-2021-43798 on port 3000?
- A path-traversal flaw in Grafana 8.0.0–8.3.0 let an unauthenticated attacker read arbitrary files (including grafana.ini and secrets) via plugin URLs on port 3000. Patch Grafana and never expose it directly to the internet.