Port reference
Port 69 (UDP) – TFTP
Trivial File Transfer Protocol — minimal, unauthenticated UDP file transfer.
Quick facts
- Transport
- udp
- Category
- Well-known
- TLS
- Cleartext
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open only where a TFTP server is deliberately enabled — PXE boot, network device backups, IP phone provisioning. Should never face the internet.
What is port 69 used for?
Port 69 hosts TFTP (Trivial File Transfer Protocol), a deliberately minimal UDP file-transfer protocol with no login and no encryption. Because it is so simple, it is the standard choice for PXE network boot, backing up and loading router and switch firmware and configs, and provisioning IP phones. Common servers include tftpd-hpa, atftpd, and the TFTP service bundled with network management tools.
When would you open it?
You open port 69 on an internal network when you set up PXE booting for installing operating systems, or when a switch, router, or VoIP phone needs to pull firmware or configuration from a TFTP server. Only enable it while that workflow is active, and keep it on a private management network.
Is it safe to open?
TFTP has no authentication, so anyone who can reach it may read or write the served files — never expose it to the internet and keep it on an isolated segment behind a firewall. See the security notes below.
How to check if this port is open
ss -tulpn | grep :69
nmap -sU -p 69 <target>netstat -ano | findstr :69
Test-NetConnection <host> -Port 69 # TCP onlylsof -i :69
nmap -sU -p 69 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 69 to your device's local IP, internal port 69, protocol UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 69/udpsudo firewall-cmd --permanent --add-port=69/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 69 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 69" -Direction Inbound -Protocol UDP -LocalPort 69 -Action AllowSecurity & risks
Use a secure alternative
This is a legacy or cleartext protocol. Prefer the encrypted equivalent:
Common attacks
- Unauthenticated download of device configs and firmware
- Arbitrary file read/write via path traversal (../)
- Overwriting boot/config files to plant backdoors
- Buffer-overflow RCE in older TFTP daemons
Hardening
- Disable TFTP unless strictly required; prefer SFTP/SCP
- Bind to an isolated management VLAN, never the internet
- Restrict access by IP allowlist and a firewall on UDP 69
- Chroot the server and make the file root read-only where possible
- Patch the daemon; old TFTP servers carry overflow CVEs
How to block this port
sudo ufw deny 69/udpsudo firewall-cmd --permanent --remove-port=69/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 69 -j DROPNew-NetFirewallRule -DisplayName "Block 69" -Direction Inbound -Protocol UDP -LocalPort 69 -Action Blocknmap snippet
nmap -sU -p69 --script tftp-enum <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is TFTP secure?
- No. TFTP has no authentication and no encryption, so anyone who can reach UDP 69 may read or write files the server exposes. Use it only on isolated, firewalled networks.
- What is TFTP used for?
- It is used for lightweight transfers like PXE network boot, loading router/switch configs and firmware, and provisioning IP phones — tasks that need simplicity over security.