Skip to content
ProtocolPorts

Port reference

Port 6667 (TCP) – IRC (Internet Relay Chat)

Default plaintext port for Internet Relay Chat servers; TLS IRC typically uses 6697.

tcpRegistered

Quick facts

Transport
tcp
Category
Registered
Risk level
High

Frequently targeted — restrict exposure and harden it.

Default state

Open on IRC servers, usually unencrypted on 6667 (TLS variant on 6697). Legitimate use is real-time chat, but the protocol is also a historic botnet C2 channel.

What is port 6667 used for?

Port 6667 is the classic port for Internet Relay Chat (IRC), a simple text-based, channel-oriented chat protocol that has powered online communities for decades. Clients like HexChat, mIRC, irssi, and WeeChat connect to IRC servers such as ircd-based networks on this port. Traffic on 6667 is unencrypted; networks that support TLS usually offer it on 6697 instead.

When would you open it?

Open 6667 if you are running your own IRC server and want people to be able to connect to it. As a regular chat user you do not need to open anything inbound, since your client makes an outbound connection to the server.

Is it safe to open?

Plain 6667 is unencrypted, so prefer TLS on 6697 and keep your IRC daemon updated and properly configured if you host one. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :6667
nmap -p 6667 <target>
Windows
netstat -ano | findstr :6667
Test-NetConnection <host> -Port 6667
macOS
lsof -i :6667
nmap -p 6667 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 6667 to your device's local IP, internal port 6667, protocol TCP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 6667/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=6667/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 6667 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 6667" -Direction Inbound -Protocol TCP -LocalPort 6667 -Action Allow

Security & risks

Common attacks

  • Botnet command-and-control over IRC channels
  • Detection of compromised hosts beaconing to IRC C2
  • Abuse of open/misconfigured IRCd for spam and flooding
  • Exploitation of vulnerable or backdoored IRC daemons

Hardening

  • Use TLS IRC (6697) and disable plaintext 6667 where possible
  • Monitor egress for unexpected outbound IRC — a classic C2 signal
  • Lock down IRCd config: disable open relays, require auth/SASL
  • Keep the IRC daemon patched and run it as an unprivileged user
  • Firewall IRC ports to expected users and block from servers/IoT

How to block this port

Linux (ufw)
sudo ufw deny 6667/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=6667/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 6667 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 6667" -Direction Inbound -Protocol TCP -LocalPort 6667 -Action Block

nmap snippet

nmap -p6667 --script irc-info,irc-botnet-channels <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 194Port 6697Port 6660Port 113

Frequently asked questions

Is port 6667 traffic always malicious?
No. 6667 is the standard port for legitimate IRC chat. However, because IRC is simple and channel-based, malware has long used it for command-and-control, so unexpected outbound 6667 from servers or IoT is suspicious.
Why is unexpected IRC traffic a red flag on a server?
Servers and IoT devices rarely need IRC. Outbound connections to 6667 often indicate a compromised host beaconing to a botnet C2 channel; the irc-botnet-channels NSE script helps spot known C2 patterns.

Related guides