Port reference
Port 389 (TCP/UDP) – LDAP
LDAP — the cleartext directory query protocol used to read and write Active Directory.
Quick facts
- Transport
- tcp, udp
- Category
- Well-known
- TLS
- Cleartext
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on every Active Directory domain controller. Cleartext by default; should not be exposed to untrusted networks.
What is port 389 used for?
Port 389 is the default for LDAP (Lightweight Directory Access Protocol), used to look up and update directory data like users, groups, and computers. In Windows networks it's how clients and apps talk to Active Directory: every domain controller listens on 389 so logins, group lookups, and apps that authenticate against AD or OpenLDAP can work. By default this traffic is cleartext; the encrypted version is LDAPS on port 636.
When would you open it?
You'd allow port 389 so domain-joined computers and directory-aware applications can query your directory server. Keep it within your internal/management network where those clients live — it should never be reachable from the internet.
Is it safe to open?
Plain LDAP is unencrypted and a known target for credential sniffing and relay attacks, so prefer LDAPS/StartTLS, disable anonymous binds, and restrict it to trusted networks. See the security notes below.
How to check if this port is open
ss -tulpn | grep :389
nmap -p 389 <target>netstat -ano | findstr :389
Test-NetConnection <host> -Port 389lsof -i :389
nmap -p 389 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 389 to your device's local IP, internal port 389, protocol TCP/UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 389/tcpsudo firewall-cmd --permanent --add-port=389/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 389 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 389" -Direction Inbound -Protocol TCP -LocalPort 389 -Action AllowSecurity & risks
Use a secure alternative
This is a legacy or cleartext protocol. Prefer the encrypted equivalent:
Common attacks
- Anonymous and unauthenticated bind enumeration
- Directory enumeration (users, groups, SPNs, ACLs)
- LDAP relay (NTLM relay to LDAP)
- Credential sniffing of cleartext simple binds
Hardening
- Prefer LDAPS (636) or StartTLS; avoid cleartext simple binds
- Enforce LDAP signing and channel binding to defeat relay
- Disable anonymous binds
- Restrict 389 to trusted management networks
- Monitor for bulk/abnormal LDAP queries (BloodHound-style)
How to block this port
sudo ufw deny 389/tcpsudo firewall-cmd --permanent --remove-port=389/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 389 -j DROPNew-NetFirewallRule -DisplayName "Block 389" -Direction Inbound -Protocol TCP -LocalPort 389 -Action Blocknmap snippet
nmap -p389 --script ldap-rootdse,ldap-search <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 389 used for?
- Port 389 is LDAP, the protocol clients and applications use to query and modify the Active Directory database — looking up users, groups, computers, and policies.
- Is LDAP on port 389 encrypted?
- No. Plain LDAP on 389 is cleartext, so simple-bind credentials and directory data can be sniffed. Use LDAPS on 636 or StartTLS for encryption.