Skip to content
ProtocolPorts

Port reference

Port 3690 (TCP) – Subversion (svnserve)

Default port for the Subversion svn:// protocol served by svnserve.

tcpRegistered

Quick facts

Transport
tcp
Category
Registered
Risk level
High

Frequently targeted — restrict exposure and harden it.

Default state

Open on hosts running svnserve. Frequently configured for anonymous read (or even write) access.

What is port 3690 used for?

Port 3690 is the default port for Subversion's svn:// protocol, served by the standalone svnserve daemon. It lets Subversion (SVN) clients check out, commit, and browse a version-control repository — a lightweight alternative to running SVN over SSH or HTTPS. Command-line svn and GUI clients like TortoiseSVN connect to it when you use an svn:// URL.

When would you open it?

Open or forward port 3690 if you host an SVN repository with svnserve and need developers or build systems to reach it across the network. If you only access SVN over SSH or HTTPS, you don't need this port open at all.

Is it safe to open?

The native svn:// protocol is unencrypted and often allows anonymous read, so credentials and source code can be exposed. Prefer svn+ssh:// or HTTPS, require authentication, and keep it off the public internet. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :3690
nmap -p 3690 <target>
Windows
netstat -ano | findstr :3690
Test-NetConnection <host> -Port 3690
macOS
lsof -i :3690
nmap -p 3690 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 3690 to your device's local IP, internal port 3690, protocol TCP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 3690/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=3690/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 3690 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 3690" -Direction Inbound -Protocol TCP -LocalPort 3690 -Action Allow

Security & risks

Common attacks

  • Anonymous checkout of source code and repository history
  • Brute force of svnserve passwd credentials
  • Exposure of secrets committed into history (keys, passwords)
  • Exploiting unpatched svnserve parsing vulnerabilities

Hardening

  • Prefer svn+ssh:// or HTTPS (mod_dav_svn) over the cleartext svn:// protocol
  • Disable anonymous access (anon-access = none) and require auth
  • Restrict source IPs / run behind a VPN
  • Scrub secrets from history and rotate any that leaked
  • Keep Subversion patched and run svnserve as an unprivileged user

How to block this port

Linux (ufw)
sudo ufw deny 3690/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=3690/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 3690 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 3690" -Direction Inbound -Protocol TCP -LocalPort 3690 -Action Block

nmap snippet

nmap -p3690 -sV <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 22Port 443Port 9418Port 80

Frequently asked questions

Is svnserve on port 3690 encrypted?
No. The native svn:// protocol is cleartext, so credentials and source code travel unencrypted. Use svn+ssh:// or HTTPS via Apache mod_dav_svn instead.
Can anyone read my repository on port 3690?
If anon-access is left at the default 'read', yes — anyone who can reach 3690 can check out your full source and history. Set anon-access = none and require authentication.

Related guides