Skip to content
ProtocolPorts

Port reference

Port 5000 (TCP) – UPnP / common dev server

A heavily overloaded port used by UPnP control points, the Flask dev server, the Docker registry, and macOS AirPlay (Control Center).

tcpRegistered

Quick facts

Transport
tcp
Category
Registered
Risk level
High

Frequently targeted — restrict exposure and harden it.

Default state

Varies by service. Flask's dev server and the Docker registry bind here when run; on macOS, AirPlay Receiver listens on 5000. Often opened unintentionally during development.

What is port 5000 used for?

Port 5000 is used by many different programs, so what's running depends on the host. It's the default for the Flask/Werkzeug web development server, the self-hosted Docker registry, UPnP control points, and — on modern macOS — the AirPlay Receiver (which is why Macs often show 5000 in use). Developers most commonly meet it as the local address (localhost:5000) where a Flask or .NET app runs during development.

When would you open it?

Open or forward port 5000 if you intentionally run a service on it — for example a self-hosted Docker registry or a small web app — and need it reachable from other machines. For local development you usually don't open it beyond your own computer.

Is it safe to open?

A Flask dev server with debug mode on, or an unauthenticated Docker registry, are risky to expose. Don't run dev servers in production, require auth and TLS on any registry, and front public apps with a reverse proxy. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :5000
nmap -p 5000 <target>
Windows
netstat -ano | findstr :5000
Test-NetConnection <host> -Port 5000
macOS
lsof -i :5000
nmap -p 5000 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 5000 to your device's local IP, internal port 5000, protocol TCP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 5000/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=5000/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 5000 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 5000" -Direction Inbound -Protocol TCP -LocalPort 5000 -Action Allow

Security & risks

Common attacks

  • Hitting an exposed Flask/Werkzeug debugger for remote code execution
  • Pushing or pulling images from an unauthenticated Docker registry
  • UPnP abuse to map ports or reach internal services (SSRF-style pivots)
  • Information disclosure from debug pages and verbose app errors

Hardening

  • Never run a development server (Flask/Werkzeug debug) in production
  • Bind dev and registry services to localhost, not 0.0.0.0
  • Require authentication and TLS on any exposed Docker registry
  • Disable UPnP on internet-facing gateways and segment IoT devices
  • Firewall 5000 and front production apps with a hardened reverse proxy

How to block this port

Linux (ufw)
sudo ufw deny 5000/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=5000/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 5000 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 5000" -Direction Inbound -Protocol TCP -LocalPort 5000 -Action Block

nmap snippet

nmap -p5000 --script http-title <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 5001Port 5443Port 8080Port 2375

Frequently asked questions

Why is port 5000 associated with so many services?
It's a popular default. UPnP control, the Flask/Werkzeug dev server, the Docker registry, and macOS AirPlay Receiver all use 5000, so what you find there depends entirely on the host.
What's the danger of an exposed Flask app on 5000?
If the Werkzeug debugger is enabled, an attacker can open an interactive console and execute arbitrary Python — full RCE. Development servers also leak stack traces and aren't built to withstand hostile traffic.

Related guides