Port reference
Port 9050 (TCP) – Tor SOCKS proxy
Local SOCKS5 proxy exposed by the Tor client to route application traffic over the Tor network.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Listening on 127.0.0.1 only on hosts running the Tor daemon. Dangerous when bound to a public interface, where it acts as an open proxy.
What is port 9050 used for?
Port 9050 is the default SOCKS5 proxy exposed by the standalone Tor client daemon. You point an application's proxy settings at 127.0.0.1:9050 and Tor routes that traffic through its onion-routing network for anonymity. Command-line tools like curl, messaging apps, and proxy wrappers such as torsocks use it this way. Note that the Tor Browser bundle uses a separate port (9150), and a companion control port (9051) lets tools manage Tor's circuits.
When would you open it?
You normally would not open 9050 to the network at all. Tor keeps it on localhost so only programs on the same machine can route through it. If you genuinely need a shared Tor proxy for other hosts, bind it to a private interface behind a firewall and restrict it to specific trusted clients.
Is it safe to open?
If you expose 9050 publicly it becomes an open proxy that anyone can relay traffic through, getting your IP blamed for abuse. Keep it bound to 127.0.0.1 and reachable only by local apps. See the security notes below.
How to check if this port is open
ss -tulpn | grep :9050
nmap -p 9050 <target>netstat -ano | findstr :9050
Test-NetConnection <host> -Port 9050lsof -i :9050
nmap -p 9050 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 9050 to your device's local IP, internal port 9050, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 9050/tcpsudo firewall-cmd --permanent --add-port=9050/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 9050 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 9050" -Direction Inbound -Protocol TCP -LocalPort 9050 -Action AllowSecurity & risks
Common attacks
- Open-proxy abuse when 9050 is bound to a public interface
- Relaying spam, scraping, or attack traffic through the host
- Scanning for exposed Tor SOCKS ports to anonymize malicious traffic
- Pivoting via an unprotected control port (9051) to reconfigure Tor
Hardening
- Keep 9050 bound to 127.0.0.1 — never expose it to the network
- Protect the control port 9051 with CookieAuthentication or a password
- Firewall the port so only local applications can reach it
- Run Tor as an unprivileged user and keep it patched
- Monitor for unexpected outbound Tor traffic on servers
How to block this port
sudo ufw deny 9050/tcpsudo firewall-cmd --permanent --remove-port=9050/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 9050 -j DROPNew-NetFirewallRule -DisplayName "Block 9050" -Direction Inbound -Protocol TCP -LocalPort 9050 -Action Blocknmap snippet
nmap -p9050 --script socks-open-proxy,socks-auth-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is port 9050 safe to leave open?
- Only on localhost. Tor binds 9050 to 127.0.0.1 by design. If you rebind it to a public IP it becomes an open SOCKS proxy that anyone can route abusive traffic through.
- What is the difference between 9050 and 9051?
- 9050 is the SOCKS proxy applications connect to. 9051 is Tor's control port, used to manage the daemon. An unauthenticated 9051 lets an attacker reconfigure or deanonymize Tor.