Port reference
Port 5938 (TCP) – TeamViewer
TeamViewer remote-support and remote-control protocol, used for attended and unattended access.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Used as an outbound connection by the TeamViewer client to its relay servers. The port is rarely listened on locally but enables remote control once the client runs.
What is port 5938 used for?
Port 5938 is the main connection port for TeamViewer, the popular remote-support and remote-control application. The TeamViewer client makes an outbound connection to TeamViewer's servers on 5938 (falling back to 443 or 80 if it is blocked), which then relays remote help-desk sessions and unattended access to your devices. Because the connection is outbound, you usually do not need to open an inbound port for it to work.
When would you open it?
In most cases you do not need to open port 5938 at all, since TeamViewer connects out on its own. On restrictive corporate firewalls, allowing outbound traffic to port 5938 simply gives TeamViewer its fastest, most reliable path instead of falling back to web ports.
Is it safe to open?
The main risk is account takeover through reused passwords rather than the port itself, so enable two-factor authentication on your TeamViewer account. See the security notes below.
How to check if this port is open
ss -tulpn | grep :5938
nmap -p 5938 <target>netstat -ano | findstr :5938
Test-NetConnection <host> -Port 5938lsof -i :5938
nmap -p 5938 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 5938 to your device's local IP, internal port 5938, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 5938/tcpsudo firewall-cmd --permanent --add-port=5938/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5938 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 5938" -Direction Inbound -Protocol TCP -LocalPort 5938 -Action AllowSecurity & risks
Common attacks
- Account takeover via credential stuffing and reused passwords
- Abuse of unattended-access passwords for persistent remote control
- Social-engineering victims into installing or sharing TeamViewer IDs
- Pivoting from a compromised TeamViewer account to managed endpoints
Hardening
- Enable two-factor authentication on every TeamViewer account
- Use strong, unique passwords and allowlist trusted devices
- Disable unattended access where it is not strictly required
- Restrict which accounts may connect and review the connection log
- Keep the client updated and uninstall it where unused
How to block this port
sudo ufw deny 5938/tcpsudo firewall-cmd --permanent --remove-port=5938/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5938 -j DROPNew-NetFirewallRule -DisplayName "Block 5938" -Direction Inbound -Protocol TCP -LocalPort 5938 -Action Blocknmap snippet
nmap -p5938 --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Why does TeamViewer use port 5938?
- TeamViewer prefers an outbound TCP connection to its relay servers on 5938 for the best performance, falling back to 443 or 80 if 5938 is blocked. It rarely needs an inbound open port.
- How are TeamViewer accounts compromised?
- The main vector is credential stuffing — attackers reuse passwords leaked elsewhere to log into accounts, then control any device linked to that account. Two-factor authentication blocks this.