Port reference
Port 5671 (TCP) – AMQPS (AMQP over TLS)
Default port for AMQPS, the TLS-secured variant of AMQP 0-9-1 used by RabbitMQ brokers; the plaintext form runs on 5672.
Quick facts
- Transport
- tcp
- Category
- Registered
- TLS
- Encrypted
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Reserved for TLS-wrapped AMQP. Encryption is in place, but RabbitMQ still ships a default guest/guest account, and plaintext 5672 or the management UI on 15672 may also be reachable.
What is port 5671 used for?
Port 5671 is the default port for AMQPS, the TLS-encrypted version of the AMQP messaging protocol used by RabbitMQ. Applications use it as a secure pipe to publish and consume messages through queues, letting different services pass work to each other reliably. It is the encrypted counterpart of plaintext AMQP on port 5672, and the RabbitMQ management web UI runs separately on port 15672.
When would you open it?
Open port 5671 when application servers, workers, or microservices need to reach a RabbitMQ broker over an encrypted connection, typically across a private network or between cloud services. If everything that talks to the broker runs on the same host, the port does not need to be opened externally.
Is it safe to open?
TLS protects the traffic but not weak accounts, so delete the default guest user and keep the broker on a private network. See the security notes below.
How to check if this port is open
ss -tulpn | grep :5671
nmap -p 5671 <target>netstat -ano | findstr :5671
Test-NetConnection <host> -Port 5671lsof -i :5671
nmap -p 5671 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 5671 to your device's local IP, internal port 5671, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 5671/tcpsudo firewall-cmd --permanent --add-port=5671/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5671 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 5671" -Direction Inbound -Protocol TCP -LocalPort 5671 -Action AllowSecurity & risks
Common attacks
- Login with default guest/guest credentials despite TLS
- Downgrade to plaintext AMQP on 5672 when both ports are open
- Exploitation of weak TLS configs or missing certificate validation
- Access to the management UI/API on 15672 for full broker control
Hardening
- Delete or restrict the default guest user; enforce strong credentials
- Disable plaintext 5672 so clients cannot be downgraded
- Use modern TLS versions and strong ciphers; validate certificates
- Bind to a private interface and firewall 5671 (and 15672) to trusted hosts
- Use vhosts and per-user permissions, and keep RabbitMQ and Erlang patched
How to block this port
sudo ufw deny 5671/tcpsudo firewall-cmd --permanent --remove-port=5671/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5671 -j DROPNew-NetFirewallRule -DisplayName "Block 5671" -Direction Inbound -Protocol TCP -LocalPort 5671 -Action Blocknmap snippet
nmap -p5671 --script ssl-cert,amqp-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- How is port 5671 different from 5672?
- Port 5671 carries AMQP inside a TLS tunnel, encrypting messages and credentials, while 5672 is the same protocol in plaintext. Use 5671 and disable 5672 where possible.
- Does AMQPS on 5671 remove the need to fix default credentials?
- No. TLS encrypts traffic but not access control. RabbitMQ's default guest/guest account still applies, so delete or restrict it, enforce strong credentials, and firewall the management UI.