Port reference
Port 5601 (TCP) – Kibana
Default port for Kibana, the web UI for visualizing and managing Elasticsearch data.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Kibana often binds to 0.0.0.0 with no authentication unless the Elastic security stack is configured, exposing dashboards and the underlying Elasticsearch data to anyone reaching 5601.
What is port 5601 used for?
Port 5601 is the default port for Kibana, the web dashboard for the Elastic Stack (ELK). It lets you search, chart, and explore data and logs stored in Elasticsearch through a browser. Teams use it to build dashboards, monitor application logs, and investigate metrics, and Kibana talks to the Elasticsearch backend on port 9200 behind the scenes.
When would you open it?
Open port 5601 so that people on your team can reach the Kibana dashboard in their browser, typically across an internal network or VPN. For remote access it is best placed behind a reverse proxy with login rather than opening the port directly to the internet.
Is it safe to open?
Out of the box Kibana may have no login and exposes everything in Elasticsearch, so enable authentication and keep it off the public internet. See the security notes below.
How to check if this port is open
ss -tulpn | grep :5601
nmap -p 5601 <target>netstat -ano | findstr :5601
Test-NetConnection <host> -Port 5601lsof -i :5601
nmap -p 5601 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 5601 to your device's local IP, internal port 5601, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 5601/tcpsudo firewall-cmd --permanent --add-port=5601/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5601 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 5601" -Direction Inbound -Protocol TCP -LocalPort 5601 -Action AllowSecurity & risks
Common attacks
- Unauthenticated access to dashboards exposing sensitive Elasticsearch data
- CVE-2019-7609 Timelion prototype-pollution remote code execution
- Pivoting into the backing Elasticsearch cluster on 9200
- Information disclosure of logs, metrics, and indexed records
Hardening
- Bind to localhost or a private interface (server.host); never expose 5601 to the internet
- Enable Elastic Stack security (authentication and RBAC)
- Require TLS and put a reverse proxy with auth in front for remote access
- Firewall 5601 to trusted hosts and segment from Elasticsearch
- Keep Kibana and Elasticsearch patched
How to block this port
sudo ufw deny 5601/tcpsudo firewall-cmd --permanent --remove-port=5601/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5601 -j DROPNew-NetFirewallRule -DisplayName "Block 5601" -Direction Inbound -Protocol TCP -LocalPort 5601 -Action Blocknmap snippet
nmap -p5601 --script http-title <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is it safe to expose Kibana on port 5601?
- No. Without the Elastic security stack, Kibana has no authentication and exposes all backing Elasticsearch data. Bind to localhost, enable authentication and TLS, and firewall the port.
- What was the Kibana Timelion RCE?
- CVE-2019-7609 was a prototype-pollution flaw in the Timelion visualizer that let an attacker run arbitrary code on the Kibana host. Patch Kibana and restrict access to 5601.