Port reference
Port 6379 (TCP) – Redis
Default port for the Redis in-memory data store and cache.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Historically Redis bound to all interfaces with NO authentication by default; modern versions ship 'protected mode' binding to localhost. Many exposed instances remain unauthenticated.
What is port 6379 used for?
Port 6379 is the default port for Redis, a popular high-performance in-memory data store used as a cache, message broker, and database. Applications connect to it to read and write keys with very low latency, and most Redis client libraries and tools (including the redis-cli command-line client) talk to this port by default. It is also used by Redis-compatible servers such as Valkey and KeyDB.
When would you open it?
Open or forward port 6379 when an application on another machine needs to reach your Redis server, for example a web app connecting to a separate cache or database host. In most deployments Redis is kept on a private network and reached only by trusted internal services rather than exposed publicly.
Is it safe to open?
Redis grants full read and write access to whoever can connect, so the safe approach is to keep it bound to localhost or a private network, require a password, and never expose it directly to the internet. See the security notes below.
How to check if this port is open
ss -tulpn | grep :6379
nmap -p 6379 <target>netstat -ano | findstr :6379
Test-NetConnection <host> -Port 6379lsof -i :6379
nmap -p 6379 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 6379 to your device's local IP, internal port 6379, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 6379/tcpsudo firewall-cmd --permanent --add-port=6379/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 6379 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 6379" -Direction Inbound -Protocol TCP -LocalPort 6379 -Action AllowSecurity & risks
Common attacks
- Unauthenticated access to read, modify, or wipe all data
- RCE via config rewrite (writing SSH keys or cron jobs through CONFIG SET/SAVE)
- Module loading abuse for remote code execution
- Data theft and ransom of exposed instances
Hardening
- Bind to localhost or a private interface; keep protected-mode on
- Require authentication (requirepass / ACLs) with a strong password
- Never expose 6379 to the internet; firewall to trusted hosts only
- Rename or disable dangerous commands (CONFIG, FLUSHALL, MODULE) and require TLS
- Run Redis as an unprivileged user and patch regularly
How to block this port
sudo ufw deny 6379/tcpsudo firewall-cmd --permanent --remove-port=6379/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 6379 -j DROPNew-NetFirewallRule -DisplayName "Block 6379" -Direction Inbound -Protocol TCP -LocalPort 6379 -Action Blocknmap snippet
nmap -p6379 --script redis-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Does Redis require a password by default?
- Historically no — early Redis had no authentication, which led to mass compromises. Always set requirepass or ACLs, bind to localhost, and keep protected mode enabled.
- How does an exposed Redis lead to remote code execution?
- An unauthenticated attacker can use CONFIG SET/SAVE to write files such as SSH authorized_keys or cron jobs, or load a malicious module, turning data access into full host compromise.