Port reference
Port 502 (TCP) – Modbus TCP
Modbus over TCP/IP — reads and writes coils and registers on PLCs, RTUs, and industrial I/O.
Quick facts
- Transport
- tcp
- Category
- Well-known
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on PLCs, RTUs, and gateways speaking Modbus TCP, with no authentication or encryption on the protocol.
What is port 502 used for?
Port 502 hosts Modbus TCP, the network version of the long-standing Modbus protocol used in industrial automation. A master such as a SCADA system, HMI, or engineering tool reads and writes coils and registers on a slave device like a PLC, RTU, or I/O gateway. It's common with hardware from Schneider Electric, Siemens, and Wago, and with software libraries like libmodbus and pymodbus across factories, utilities, and building systems.
When would you open it?
Open port 502 only inside a controlled industrial network so SCADA software and HMIs can poll the PLCs and devices that speak Modbus TCP. It belongs on a protected control or OT segment, not on a general office network and never on the public internet.
Is it safe to open?
Modbus has no authentication or encryption, so anyone who reaches the port can read and control equipment; keep it isolated on a segmented network reachable only by authorized hosts. See the security notes below.
How to check if this port is open
ss -tulpn | grep :502
nmap -p 502 <target>netstat -ano | findstr :502
Test-NetConnection <host> -Port 502lsof -i :502
nmap -p 502 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 502 to your device's local IP, internal port 502, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 502/tcpsudo firewall-cmd --permanent --add-port=502/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 502 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 502" -Direction Inbound -Protocol TCP -LocalPort 502 -Action AllowSecurity & risks
Common attacks
- Unauthorized reads of coils, registers, and process state
- Unauthorized writes flipping coils or registers to control equipment
- Device and function-code enumeration via modbus-discover
- Denial of service by forcing outputs or flooding the device
Hardening
- Never expose port 502 to the internet — isolate Modbus on an OT segment
- Segment with firewalls/DMZ and restrict to authorized SCADA hosts
- Use a Modbus-aware gateway or proxy that enforces read-only where possible
- Monitor with an ICS IDS for unexpected write function codes
How to block this port
sudo ufw deny 502/tcpsudo firewall-cmd --permanent --remove-port=502/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 502 -j DROPNew-NetFirewallRule -DisplayName "Block 502" -Direction Inbound -Protocol TCP -LocalPort 502 -Action Blocknmap snippet
nmap -p502 --script modbus-discover <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Does Modbus TCP have authentication?
- No. Modbus has no authentication or encryption. Any host that reaches port 502 can read and write coils and registers, giving direct control over the connected equipment.
- Can Modbus be made secure?
- The protocol itself cannot be authenticated, so security relies on network controls: strict segmentation, firewalls, allowlisting SCADA masters, and ICS-aware monitoring. Modbus/TCP Security (TLS) exists but is rarely deployed.