Port reference
Port 5672 (TCP) – AMQP (RabbitMQ)
Default port for AMQP 0-9-1, the messaging protocol used by RabbitMQ brokers.
Quick facts
- Transport
- tcp
- Category
- Registered
- TLS
- Cleartext
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
RabbitMQ ships with a default guest/guest account; in older or misconfigured setups the broker binds broadly and the management UI on 15672 may also be reachable, exposing queues and credentials.
What is port 5672 used for?
Port 5672 is the default port for AMQP, the Advanced Message Queuing Protocol used by RabbitMQ message brokers. Applications connect here to publish and consume messages through queues, letting separate services hand off tasks and decouple from each other in distributed systems. Client libraries for Python (Pika, Celery), Java (Spring AMQP), .NET, and Node.js all talk to RabbitMQ over this port, with the management web UI on 15672 and the encrypted version (AMQPS) on 5671.
When would you open it?
Open port 5672 when application servers, background workers, or microservices need to reach a RabbitMQ broker on another machine, usually over a private network. If your app and broker share a host, it can stay on localhost and the port need not be opened externally.
Is it safe to open?
Plain AMQP is unencrypted and RabbitMQ ships a default guest account, so prefer AMQPS on 5671, replace default credentials, and keep the broker on a private network. See the security notes below.
How to check if this port is open
ss -tulpn | grep :5672
nmap -p 5672 <target>netstat -ano | findstr :5672
Test-NetConnection <host> -Port 5672lsof -i :5672
nmap -p 5672 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 5672 to your device's local IP, internal port 5672, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 5672/tcpsudo firewall-cmd --permanent --add-port=5672/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5672 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 5672" -Direction Inbound -Protocol TCP -LocalPort 5672 -Action AllowSecurity & risks
Use a secure alternative
This is a legacy or cleartext protocol. Prefer the encrypted equivalent:
Common attacks
- Login with default guest/guest credentials to read and publish messages
- Message interception and queue tampering on unencrypted AMQP
- Access to the management UI/API on 15672 for full broker control
- Information disclosure of vhosts, queues, and message payloads
Hardening
- Delete or restrict the default guest user; enforce strong credentials
- Bind to a private interface and firewall 5672 (and 15672) to trusted hosts
- Require TLS for AMQP and the management interface
- Use vhosts and per-user permissions to segment access
- Keep RabbitMQ and Erlang patched and audit access
How to block this port
sudo ufw deny 5672/tcpsudo firewall-cmd --permanent --remove-port=5672/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5672 -j DROPNew-NetFirewallRule -DisplayName "Block 5672" -Direction Inbound -Protocol TCP -LocalPort 5672 -Action Blocknmap snippet
nmap -p5672 --script amqp-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What are the default RabbitMQ credentials?
- RabbitMQ creates a default guest/guest account that, in older versions, could log in remotely. Delete or restrict the guest user, set strong credentials, and firewall ports 5672 and 15672.
- Is AMQP traffic on port 5672 encrypted?
- Not by default — plain 5672 is unencrypted, so messages and credentials can be intercepted. Use AMQPS on 5671 or enable TLS, and require it for the management UI as well.