Port reference
Port 8500 (TCP) – HashiCorp Consul HTTP API
HTTP API and web UI for HashiCorp Consul service discovery, KV store, and health checks.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on Consul agents/servers. Without ACLs the API is unauthenticated, so anyone reaching 8500 can read and modify cluster state.
What is port 8500 used for?
Port 8500 serves the HashiCorp Consul HTTP API and web UI. Applications and operators use it for service discovery, the key/value store, and health checks across a Consul cluster, and the consul CLI talks to it too. Consul's DNS interface runs separately on port 8600, while gossip and RPC use other ports.
When would you open it?
Open or forward 8500 when applications, the Consul UI, or operators on other machines need to query the cluster. It is normally kept on a private network shared by your Consul nodes and clients, not exposed to the internet.
Is it safe to open?
By default the API has no authentication until ACLs are enabled, so anyone who reaches 8500 can read and change cluster state; enable ACLs and keep it on a trusted network. See the security notes below.
How to check if this port is open
ss -tulpn | grep :8500
nmap -p 8500 <target>netstat -ano | findstr :8500
Test-NetConnection <host> -Port 8500lsof -i :8500
nmap -p 8500 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 8500 to your device's local IP, internal port 8500, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 8500/tcpsudo firewall-cmd --permanent --add-port=8500/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8500 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 8500" -Direction Inbound -Protocol TCP -LocalPort 8500 -Action AllowSecurity & risks
Common attacks
- Exposed unauthenticated API leaking service catalog and KV secrets
- Remote code execution via registered script health checks
- Tampering with service discovery to reroute or poison traffic
- Internal recon by enumerating nodes, services, and metadata
Hardening
- Enable Consul ACLs with a default-deny policy
- Bind the API to private interfaces; never expose 8500 to the internet
- Disable script checks or restrict them (enable_script_checks=false)
- Require TLS and tokens for API access
- Firewall 8500/8600 to cluster members and trusted clients only
How to block this port
sudo ufw deny 8500/tcpsudo firewall-cmd --permanent --remove-port=8500/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8500 -j DROPNew-NetFirewallRule -DisplayName "Block 8500" -Direction Inbound -Protocol TCP -LocalPort 8500 -Action Blocknmap snippet
nmap -p8500 --script http-title,banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 8500 used for?
- It serves the HashiCorp Consul HTTP API and web UI, used for service discovery, the key/value store, and health checks. Consul's DNS interface runs separately on 8600.
- Why is an exposed Consul API dangerous?
- Without ACLs, anyone reaching 8500 can read the service catalog and KV secrets, tamper with service discovery, and even achieve RCE through script health checks. Enable ACLs, require TLS, and keep 8500 off the internet.