Port reference
Port 520 (UDP) – RIP (Routing Information Protocol)
Distance-vector routing protocol that exchanges route tables between routers over UDP.
Quick facts
- Transport
- udp
- Category
- Well-known
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on routers running RIP; RIPv1 has no authentication and RIPv2 auth is often left disabled.
What is port 520 used for?
Port 520 (UDP) carries RIP, the Routing Information Protocol, a distance-vector routing protocol that routers use to advertise and learn routes by periodically exchanging their routing tables. You will find it on home and small-office routers, older Cisco and Juniper gear, and Unix routing daemons like routed and Quagga or FRRouting. It is a simple way for a small network to share routes automatically, though larger networks now favor OSPF.
When would you open it?
Open or allow UDP 520 only between routers that actually run RIP and need to exchange routes, such as a small multi-router LAN or a lab. There is no reason to forward it to client devices or across the internet, since only routing equipment speaks it.
Is it safe to open?
The main risk is that RIPv1 has no authentication, so a device on the segment could inject false routes; use RIPv2 with authentication and keep it on trusted internal links only. See the security notes below.
How to check if this port is open
ss -tulpn | grep :520
nmap -sU -p 520 <target>netstat -ano | findstr :520
Test-NetConnection <host> -Port 520 # TCP onlylsof -i :520
nmap -sU -p 520 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 520 to your device's local IP, internal port 520, protocol UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 520/udpsudo firewall-cmd --permanent --add-port=520/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 520 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 520" -Direction Inbound -Protocol UDP -LocalPort 520 -Action AllowSecurity & risks
Common attacks
- Route injection to redirect or blackhole traffic
- Spoofed RIP updates poisoning the routing table
- Man-in-the-middle via attacker-advertised routes
- Denial of service by injecting false or excessive routes
Hardening
- Prefer a modern protocol (OSPF) or static routes over RIP
- If RIP is required, use RIPv2 with MD5/cryptographic authentication
- Apply passive interfaces and ACLs to block RIP from untrusted segments
- Filter inbound UDP 520 at network edges and use route filters
How to block this port
sudo ufw deny 520/udpsudo firewall-cmd --permanent --remove-port=520/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 520 -j DROPNew-NetFirewallRule -DisplayName "Block 520" -Direction Inbound -Protocol UDP -LocalPort 520 -Action Blocknmap snippet
nmap -sU -p520 --script rip-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Does RIP have authentication?
- RIPv1 has none at all. RIPv2 supports simple and MD5 authentication, but it is often left disabled, so RIP updates frequently travel unauthenticated and can be spoofed.
- How is RIP attacked?
- An attacker on the segment sends forged RIP updates on UDP 520 advertising attractive routes. Routers accept them and redirect traffic, enabling interception, blackholing, or denial of service.