Port reference
Port 5684 (UDP) – CoAPS (CoAP over DTLS)
Default port for CoAPS, the DTLS-secured variant of CoAP, the lightweight REST-like IoT protocol that runs in plaintext on UDP 5683.
Quick facts
- Transport
- udp
- Category
- Registered
- TLS
- Encrypted
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Reserved for DTLS-secured CoAP. Encryption is in place, but devices may rely on weak pre-shared keys, skip mutual authentication, or also expose plaintext CoAP on 5683.
What is port 5684 used for?
Port 5684 is the default port for CoAPS, the encrypted version of CoAP (the Constrained Application Protocol) secured with DTLS. CoAP is a lightweight, web-style protocol for low-power IoT devices and sensors, and CoAPS adds confidentiality and authentication on top. It runs over UDP like plaintext CoAP on 5683 and appears in smart-home devices, industrial sensors, and IoT platforms that need secure device communication.
When would you open it?
Open port 5684 so IoT devices can exchange data securely with their gateway, controller, or cloud endpoint. It is the preferred choice over plaintext 5683 whenever sensor or actuator traffic should be encrypted, and it is best kept on a private or segmented network rather than open to the public internet.
Is it safe to open?
DTLS protects the traffic, but weak or shared pre-shared keys can still let attackers in, so use strong unique keys or certificates and segment your devices. See the security notes below.
How to check if this port is open
ss -tulpn | grep :5684
nmap -sU -p 5684 <target>netstat -ano | findstr :5684
Test-NetConnection <host> -Port 5684 # TCP onlylsof -i :5684
nmap -sU -p 5684 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 5684 to your device's local IP, internal port 5684, protocol UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 5684/udpsudo firewall-cmd --permanent --add-port=5684/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 5684 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 5684" -Direction Inbound -Protocol UDP -LocalPort 5684 -Action AllowSecurity & risks
Common attacks
- Brute force or reuse of weak DTLS pre-shared keys (PSKs)
- Fallback to plaintext CoAP on 5683 when both are reachable
- Exploitation of vulnerable embedded DTLS/CoAP stacks
- UDP-based DoS and resource exhaustion against constrained devices
Hardening
- Use CoAPS (DTLS) on 5684 instead of plaintext CoAP on 5683
- Use strong, unique PSKs or certificate-based DTLS with mutual auth
- Disable plaintext 5683 so clients cannot fall back
- Never expose IoT devices directly; keep them on segmented networks
- Patch device firmware and rate-limit UDP at the gateway
How to block this port
sudo ufw deny 5684/udpsudo firewall-cmd --permanent --remove-port=5684/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 5684 -j DROPNew-NetFirewallRule -DisplayName "Block 5684" -Direction Inbound -Protocol UDP -LocalPort 5684 -Action Blocknmap snippet
nmap -sU -p5684 --script coap-resources <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- How is port 5684 different from 5683?
- Port 5684 carries CoAP inside a DTLS tunnel for confidentiality and authentication, while 5683 is the same protocol in plaintext UDP. Use 5684 and disable 5683 where possible.
- Does DTLS on 5684 make CoAP fully secure?
- Not on its own. DTLS protects traffic, but weak or shared pre-shared keys, missing mutual authentication, and vulnerable embedded stacks still expose devices. Use strong keys or certificates and patch firmware.