Port reference
Port 631 (TCP/UDP) – IPP / CUPS
Internet Printing Protocol — the modern HTTP-based printing protocol, served by CUPS on Linux/macOS and by network printers.
Quick facts
- Transport
- tcp, udp
- Category
- Well-known
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Open on Linux/macOS hosts running CUPS and on most modern network printers/MFPs. The web admin interface listens here too.
What is port 631 used for?
Port 631 is the home of the Internet Printing Protocol (IPP), the modern, HTTP-based way computers talk to printers. On Linux and macOS it is served by CUPS (the Common Unix Printing System), which also offers a web admin interface on this port for adding and managing printers. Most network printers and multifunction devices speak IPP on 631 too, and Apple's AirPrint relies on it.
When would you open it?
On a single machine CUPS only listens locally, so you rarely touch it. You open or forward port 631 when you want to share printers across a network — for example a print server that other computers send jobs to. Only do so if you actually run a shared CUPS server or a network printer.
Is it safe to open?
Keep 631 on your local network rather than the internet, since CUPS has had serious remote vulnerabilities and its admin interface should require a login. See the security notes below.
How to check if this port is open
ss -tulpn | grep :631
nmap -p 631 <target>netstat -ano | findstr :631
Test-NetConnection <host> -Port 631lsof -i :631
nmap -p 631 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 631 to your device's local IP, internal port 631, protocol TCP/UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 631/tcpsudo firewall-cmd --permanent --add-port=631/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 631 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 631" -Direction Inbound -Protocol TCP -LocalPort 631 -Action AllowSecurity & risks
Common attacks
- CUPS unauthenticated RCE chain (CVE-2024-47176 + related, via cups-browsed)
- Printer and queue enumeration over IPP
- Exposed/unauthenticated CUPS web admin interface
- Print job interception and malicious printer attribute injection
Hardening
- Disable or firewall cups-browsed; block UDP/631 from untrusted networks
- Bind CUPS to localhost/internal interfaces; require auth on the admin UI
- Patch CUPS and printer firmware (2024 RCE chain)
- Use IPP over TLS (ipps) and disable unused printing protocols
- Never expose 631 to the internet; segment printers into a VLAN
How to block this port
sudo ufw deny 631/tcpsudo firewall-cmd --permanent --remove-port=631/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 631 -j DROPNew-NetFirewallRule -DisplayName "Block 631" -Direction Inbound -Protocol TCP -LocalPort 631 -Action Blocknmap snippet
nmap -p631 --script http-title,http-cups-info,cups-info,cups-queue-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is port 631 dangerous after the 2024 CUPS vulnerabilities?
- Yes if exposed. The 2024 chain (CVE-2024-47176 and friends) lets a remote attacker reach cups-browsed on UDP/631 and ultimately run commands when a print job starts. Patch CUPS, disable cups-browsed, and block 631 externally.
- What is the difference between IPP and CUPS on 631?
- IPP is the printing protocol; CUPS is the common server (on Linux/macOS) that speaks IPP and also serves a web admin interface on port 631.