Skip to content
ProtocolPorts

Port reference

Port 6443 (TCP) – Kubernetes API server

Default secure port for the Kubernetes API server (kube-apiserver), the control plane for the cluster.

tcpRegistered

Quick facts

Transport
tcp
Category
Registered
Risk level
High

Frequently targeted — restrict exposure and harden it.

Default state

kube-apiserver serves HTTPS on 6443. Hardened clusters require authentication and RBAC, but misconfigured ones allow anonymous access or grant broad roles, exposing full control of the cluster.

What is port 6443 used for?

Port 6443 is the default secure port for the Kubernetes API server, the control plane that runs a Kubernetes cluster. Tools like kubectl, controllers, kubelets, Helm, and managed services such as EKS, GKE, and AKS all talk to the cluster over HTTPS on this port. It is how you and your automation read and change cluster state.

When would you open it?

Open or forward 6443 only if you operate a Kubernetes cluster and need to reach its API from outside the node, for example for kubectl access, CI/CD pipelines, or admin tooling. If you do not run Kubernetes, there is no reason to have it open.

Is it safe to open?

Exposing the API server publicly is risky, so keep it on a private network or VPN and require proper authentication and RBAC for anyone who connects. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :6443
nmap -p 6443 <target>
Windows
netstat -ano | findstr :6443
Test-NetConnection <host> -Port 6443
macOS
lsof -i :6443
nmap -p 6443 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 6443 to your device's local IP, internal port 6443, protocol TCP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 6443/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=6443/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 6443 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 6443" -Direction Inbound -Protocol TCP -LocalPort 6443 -Action Allow

Security & risks

Common attacks

  • Anonymous or over-permissive RBAC access leading to full cluster takeover
  • Reading Secrets, ConfigMaps, and credentials across all namespaces
  • Deploying malicious pods to run code on nodes and pivot internally
  • Pivoting to the exposed kubelet API on 10250 for node-level execution

Hardening

  • Disable anonymous auth and enforce least-privilege RBAC
  • Bind the API server to a private network; never expose 6443 to the internet
  • Require strong authentication (certificates/OIDC) and audit logging
  • Restrict the kubelet API (10250) and use NetworkPolicies
  • Keep Kubernetes patched and rotate credentials

How to block this port

Linux (ufw)
sudo ufw deny 6443/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=6443/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 6443 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 6443" -Direction Inbound -Protocol TCP -LocalPort 6443 -Action Block

nmap snippet

nmap -p6443 --script ssl-cert,http-title <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 10250Port 2379Port 8443Port 9200

Frequently asked questions

Is it safe to expose the Kubernetes API server on port 6443?
No. If anonymous auth is enabled or RBAC is too broad, anyone reaching 6443 can take over the cluster. Disable anonymous access, enforce least-privilege RBAC, and keep the API server on a private network.
What happens if Kubernetes RBAC is misconfigured?
Over-permissive roles let attackers read Secrets, deploy pods, and execute on nodes — effectively full cluster compromise. Apply least privilege, audit bindings, and restrict the kubelet API on 10250.

Related guides