Port reference
Port 7687 (TCP) – Neo4j Bolt
Default port for the Neo4j Bolt binary protocol used by drivers and clients.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Neo4j exposes the Bolt protocol on 7687, often on 0.0.0.0 with the default neo4j/neo4j login until changed. Vulnerable versions are exploitable via deserialization (CVE-2021-34371).
What is port 7687 used for?
Port 7687 is the default port for Neo4j's Bolt protocol, the fast binary connection that official Neo4j drivers use to run Cypher queries against a graph database. Applications and the official drivers for Python, Java, JavaScript, and other languages connect here to read and write data. The Neo4j Browser and HTTP API use port 7474 instead.
When would you open it?
Open 7687 when your application servers need to reach a Neo4j database running on another host. Keep it on a private network between your app and the database; if remote access is genuinely needed, put it behind a VPN rather than exposing it to the internet.
Is it safe to open?
Bolt gives full query access to your graph and Neo4j ships with a default login, so set a strong password, enable TLS, and limit the port to trusted hosts. See the security notes below.
How to check if this port is open
ss -tulpn | grep :7687
nmap -p 7687 <target>netstat -ano | findstr :7687
Test-NetConnection <host> -Port 7687lsof -i :7687
nmap -p 7687 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 7687 to your device's local IP, internal port 7687, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 7687/tcpsudo firewall-cmd --permanent --add-port=7687/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 7687 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 7687" -Direction Inbound -Protocol TCP -LocalPort 7687 -Action AllowSecurity & risks
Common attacks
- Login with the default neo4j/neo4j credentials over Bolt
- Remote code execution via deserialization (CVE-2021-34371)
- Cypher injection from exposed application layers
- Data exfiltration of nodes and relationships
Hardening
- Change the default neo4j password immediately; enforce strong credentials
- Bind to localhost or a private interface; never expose 7687 to the internet
- Require TLS for Bolt connections
- Firewall 7687 to application hosts; restrict the HTTP port (7474)
- Keep Neo4j patched (fixes CVE-2021-34371) and audit access
How to block this port
sudo ufw deny 7687/tcpsudo firewall-cmd --permanent --remove-port=7687/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 7687 -j DROPNew-NetFirewallRule -DisplayName "Block 7687" -Direction Inbound -Protocol TCP -LocalPort 7687 -Action Blocknmap snippet
nmap -p7687 --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is CVE-2021-34371 in Neo4j Bolt?
- CVE-2021-34371 is a deserialization vulnerability in Neo4j reachable via the Bolt protocol on 7687 that can lead to remote code execution. Patch affected versions, require authentication and TLS, and keep 7687 off untrusted networks.
- How does Bolt (7687) differ from the Neo4j HTTP port (7474)?
- 7687 carries the binary Bolt protocol used by official drivers for high-performance queries, while 7474 serves the HTTP API and Browser UI. Both run Cypher and must be authenticated and firewalled.