Port reference
Port 67 (UDP) – DHCP server
DHCP server port — assigns IP addresses and network configuration to clients.
Quick facts
- Transport
- udp
- Category
- Well-known
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on DHCP servers and most routers/gateways on the local network. Not routed across the internet by design.
What is port 67 used for?
Port 67 is the server side of DHCP (Dynamic Host Configuration Protocol), which automatically hands out IP addresses and network settings to devices as they join a network. It is the port your home router uses, as well as dedicated DHCP servers like ISC dhcpd, Kea, dnsmasq, and the DHCP service built into Windows Server. Clients receive the replies on port 68.
When would you open it?
You typically don't open this on a firewall — DHCP is a local network service. You allow it when running your own DHCP server, such as a Raspberry Pi or appliance handing out leases on a home or lab network instead of the router. Only enable it if you actually run the DHCP service for that segment.
Is it safe to open?
The main risk is a rogue or competing DHCP server pointing clients to a malicious gateway, so keep it on trusted local segments and don't expose it to untrusted networks. See the security notes below.
How to check if this port is open
ss -tulpn | grep :67
nmap -sU -p 67 <target>netstat -ano | findstr :67
Test-NetConnection <host> -Port 67 # TCP onlylsof -i :67
nmap -sU -p 67 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 67 to your device's local IP, internal port 67, protocol UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 67/udpsudo firewall-cmd --permanent --add-port=67/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 67 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 67" -Direction Inbound -Protocol UDP -LocalPort 67 -Action AllowSecurity & risks
Common attacks
- Rogue DHCP server handing out malicious gateway/DNS settings
- DHCP starvation flooding the pool to cause denial of service
- DHCP spoofing for man-in-the-middle redirection
- Option-field injection and malformed-packet parsing bugs
Hardening
- Enable DHCP snooping on switches to block rogue servers
- Trust only known DHCP server ports; drop server replies on access ports
- Use port security / dynamic ARP inspection to limit starvation
- Segment and monitor DHCP traffic; alert on unexpected OFFER/ACK sources
- Keep the DHCP daemon patched against parsing vulnerabilities
How to block this port
sudo ufw deny 67/udpsudo firewall-cmd --permanent --remove-port=67/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 67 -j DROPNew-NetFirewallRule -DisplayName "Block 67" -Direction Inbound -Protocol UDP -LocalPort 67 -Action Blocknmap snippet
nmap -sU -p67 --script dhcp-discover <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the difference between port 67 and 68?
- Port 67 is the server side that receives client requests and sends offers/acknowledgements; port 68 is the client side that listens for the server's replies.
- Can DHCP be attacked from the internet?
- DHCP is a local broadcast protocol and is normally not routed across the internet, so attacks come from the local segment — making switch-level DHCP snooping the key control.