Port reference
Port 4899 (TCP) – Radmin
Famatech Radmin remote-administration server for graphical remote control of Windows hosts.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on Windows hosts running the Radmin Server service. Sometimes installed silently by malware that repurposes Radmin for remote control.
What is port 4899 used for?
Port 4899 is the default for Radmin (Remote Administrator) by Famatech, a graphical remote-control tool for Windows. The Radmin Server listens on 4899, and the Radmin Viewer client connects to it to see and control the remote desktop, transfer files, and open a remote shell — similar to VNC or RDP but with its own software and authentication.
When would you open it?
Open or forward port 4899 if you use Radmin to administer Windows machines remotely and need to reach a specific host. Only open it on machines where you've deliberately installed Radmin Server, ideally over a VPN rather than the open internet.
Is it safe to open?
Exposed Radmin attracts password-guessing, and an unexpected Radmin install can even be a sign of malware. Keep it on a VPN or internal network, use strong unique passwords, and restrict source IPs. See the security notes below.
How to check if this port is open
ss -tulpn | grep :4899
nmap -p 4899 <target>netstat -ano | findstr :4899
Test-NetConnection <host> -Port 4899lsof -i :4899
nmap -p 4899 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 4899 to your device's local IP, internal port 4899, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 4899/tcpsudo firewall-cmd --permanent --add-port=4899/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 4899 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 4899" -Direction Inbound -Protocol TCP -LocalPort 4899 -Action AllowSecurity & risks
Common attacks
- Brute force of Radmin credentials
- Abuse of Radmin as a covert malware command-and-control channel
- Scanning for exposed 4899 hosts to gain remote control
- Exploiting unpatched or misconfigured Radmin servers
Hardening
- Never expose 4899 to the internet — restrict to VPN/management networks
- Use Radmin security mode with strong, unique passwords
- Allowlist source IPs and enable connection logging
- Detect unexpected Radmin installs as a possible compromise indicator
- Keep Radmin Server updated and remove it where unused
How to block this port
sudo ufw deny 4899/tcpsudo firewall-cmd --permanent --remove-port=4899/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 4899 -j DROPNew-NetFirewallRule -DisplayName "Block 4899" -Direction Inbound -Protocol TCP -LocalPort 4899 -Action Blocknmap snippet
nmap -p4899 --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Why is Radmin sometimes flagged as malware?
- Radmin is a legitimate remote-admin tool, but attackers silently install it to control compromised hosts. An unexpected Radmin server on 4899 can therefore be an indicator of compromise.
- Is port 4899 safe to expose?
- No. Exposing Radmin on 4899 invites credential brute force and remote takeover. Keep it on internal management networks or behind a VPN and require strong authentication.