Port reference
Port 9200 (TCP) – Elasticsearch HTTP API
Default port for the Elasticsearch REST/HTTP API used to query and index data.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Older Elasticsearch versions exposed the HTTP API on 9200 with no authentication. Modern versions bind to localhost and enable security by default, but many legacy clusters remain open.
What is port 9200 used for?
Port 9200 is the default for the Elasticsearch HTTP/REST API, the interface used to index, search, and manage data in an Elasticsearch cluster. Applications, the official Elasticsearch clients, and tools like Kibana and Logstash send JSON requests to 9200 to query documents and administer indices. OpenSearch, the open-source fork, uses the same port. Node-to-node cluster traffic uses a separate transport protocol on 9300.
When would you open it?
Open or forward 9200 when applications, Kibana, or ingest tools on other machines need to query or load data into the cluster. Typically you limit it to those specific clients on a private network, and use a reverse proxy or VPN if you need access from outside.
Is it safe to open?
Open Elasticsearch clusters have caused many large data breaches because older versions had no authentication, letting anyone read or wipe every index. Bind it privately, turn on the built-in security features, and never expose it to the internet. See the security notes below.
How to check if this port is open
ss -tulpn | grep :9200
nmap -p 9200 <target>netstat -ano | findstr :9200
Test-NetConnection <host> -Port 9200lsof -i :9200
nmap -p 9200 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 9200 to your device's local IP, internal port 9200, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 9200/tcpsudo firewall-cmd --permanent --add-port=9200/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 9200 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 9200" -Direction Inbound -Protocol TCP -LocalPort 9200 -Action AllowSecurity & risks
Common attacks
- Unauthenticated REST access to read, dump, or delete all indices
- Ransom attacks that wipe indices and leave a payment note
- Information disclosure of cluster, index, and document data
- Abuse of scripting/management APIs and version-specific RCE bugs
Hardening
- Bind to localhost or a private interface (network.host); never expose 9200 to the internet
- Enable the security features (authentication and RBAC)
- Require TLS for HTTP and transport traffic
- Firewall to trusted hosts and put a reverse proxy in front if remote access is needed
- Keep Elasticsearch patched and audit access
How to block this port
sudo ufw deny 9200/tcpsudo firewall-cmd --permanent --remove-port=9200/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 9200 -j DROPNew-NetFirewallRule -DisplayName "Block 9200" -Direction Inbound -Protocol TCP -LocalPort 9200 -Action Blocknmap snippet
nmap -p9200 --script http-elasticsearch-head <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is it safe to expose Elasticsearch on port 9200?
- No. Open Elasticsearch clusters caused numerous large data breaches and ransom waves. Bind to localhost or a private network, enable security/authentication, require TLS, and firewall the port.
- Why do exposed Elasticsearch clusters get ransomed?
- With no authentication, anyone reaching the HTTP API can dump and delete every index via simple REST calls, then leave a ransom note demanding payment to restore the data.