Port reference
Port 4222 (TCP) – NATS messaging
Default client port for NATS, a high-performance cloud-native publish/subscribe and request/reply messaging system.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
NATS runs with no authentication by default, so any client that reaches 4222 can publish and subscribe to all subjects. The monitoring endpoint on 8222 may also be exposed.
What is port 4222 used for?
Port 4222 is the default client port for NATS, a fast open-source messaging system used to connect microservices and applications. Services connect to a NATS server (or cluster) to exchange messages on named subjects using publish/subscribe and request/reply patterns. Application code using NATS client libraries (Go, Node.js, Python, and others) connects here; NATS also has a separate monitoring page on port 8222.
When would you open it?
Open or forward port 4222 when you run a NATS server and need application clients or other cluster nodes to reach it across the network. In most setups it stays on a private network between your services rather than being exposed publicly.
Is it safe to open?
NATS runs with no authentication by default, so an exposed server lets anyone read and inject messages. Enable authentication (tokens or NKEYS/JWT), use TLS, and keep it on a private network. See the security notes below.
How to check if this port is open
ss -tulpn | grep :4222
nmap -p 4222 <target>netstat -ano | findstr :4222
Test-NetConnection <host> -Port 4222lsof -i :4222
nmap -p 4222 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 4222 to your device's local IP, internal port 4222, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 4222/tcpsudo firewall-cmd --permanent --add-port=4222/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 4222 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 4222" -Direction Inbound -Protocol TCP -LocalPort 4222 -Action AllowSecurity & risks
Common attacks
- Anonymous connection to subscribe and publish on all subjects
- Wildcard subscription to > to capture every message
- Message injection into application and control subjects
- Information disclosure via the monitoring endpoint on 8222
Hardening
- Enable authentication (tokens, user/password, or NKEYS/JWT)
- Use TLS for client connections and between cluster routes
- Bind to a private interface and firewall 4222 (and 8222) to trusted hosts
- Apply per-user subject permissions to limit publish/subscribe scope
- Restrict or disable the monitoring endpoint and keep NATS patched
How to block this port
sudo ufw deny 4222/tcpsudo firewall-cmd --permanent --remove-port=4222/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 4222 -j DROPNew-NetFirewallRule -DisplayName "Block 4222" -Direction Inbound -Protocol TCP -LocalPort 4222 -Action Blocknmap snippet
nmap -p4222 --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Does NATS require authentication by default?
- No. A default NATS server accepts anonymous clients on 4222, letting anyone subscribe and publish to every subject. Enable tokens, user/password, or NKEYS/JWT and apply per-user permissions.
- What is the NATS monitoring port 8222?
- NATS exposes an HTTP monitoring endpoint on 8222 that reports connections, subjects, and server state. If reachable it leaks topology and activity, so restrict or disable it and firewall the port.