Port reference
Port 3260 (TCP) – iSCSI Target
iSCSI target — exposes raw block storage (LUNs) over TCP/IP to remote initiators.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on SANs, NAS appliances, and servers serving iSCSI LUNs, frequently with no authentication or weak one-way CHAP.
What is port 3260 used for?
Port 3260 is the default port for iSCSI targets, which serve raw block storage (called LUNs) over a normal TCP/IP network. Remote machines, known as initiators — typically servers, VMware/Hyper-V hosts, or NAS clients — connect to a target and mount its LUNs as if they were locally attached disks. iSCSI is a common, low-cost SAN technology used by NAS appliances (Synology, QNAP, TrueNAS), Windows Server, and Linux to provide storage for databases, virtual machines, and backups.
When would you open it?
You open 3260 on a storage box or server that hosts iSCSI LUNs so authorized initiators can connect to their disks. It is normally allowed only on a dedicated, isolated storage network between the storage system and the servers that use it.
Is it safe to open?
Anyone who can mount a LUN reads and writes the disk directly, and iSCSI traffic is unencrypted by default. Keep it on an isolated storage network, require mutual (bidirectional) CHAP, and restrict which initiators may connect. See the security notes below.
How to check if this port is open
ss -tulpn | grep :3260
nmap -p 3260 <target>netstat -ano | findstr :3260
Test-NetConnection <host> -Port 3260lsof -i :3260
nmap -p 3260 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 3260 to your device's local IP, internal port 3260, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 3260/tcpsudo firewall-cmd --permanent --add-port=3260/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 3260 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 3260" -Direction Inbound -Protocol TCP -LocalPort 3260 -Action AllowSecurity & risks
Common attacks
- Unauthenticated LUN discovery and mounting
- Weak or one-way CHAP allowing initiator spoofing
- Cleartext data and credential interception
- Data theft or tampering on exposed block volumes
Hardening
- Require mutual (bidirectional) CHAP authentication
- Restrict targets to a dedicated, isolated storage network
- Never expose 3260 to the internet or general LAN
- Use initiator allowlists (IQN) and per-LUN ACLs
- Enable IPsec or a VLAN to protect cleartext traffic
How to block this port
sudo ufw deny 3260/tcpsudo firewall-cmd --permanent --remove-port=3260/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 3260 -j DROPNew-NetFirewallRule -DisplayName "Block 3260" -Direction Inbound -Protocol TCP -LocalPort 3260 -Action Blocknmap snippet
nmap -p3260 --script iscsi-info,iscsi-brute <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Why is an exposed iSCSI target dangerous?
- iSCSI serves raw block devices. An attacker who can reach and mount a LUN reads or writes the disk directly — stealing files, databases, or VM images, or corrupting them, without any filesystem-level permissions.
- Does iSCSI encrypt data?
- Not by default. iSCSI traffic, including CHAP exchanges, is cleartext unless wrapped in IPsec. Keep it on an isolated storage VLAN and add IPsec if it must traverse untrusted links.