Skip to content
ProtocolPorts

Port reference

Port 9300 (TCP) – Elasticsearch transport

Default port for Elasticsearch's binary transport protocol used for node-to-node and cluster communication.

tcpRegistered

Quick facts

Transport
tcp
Category
Registered
Risk level
Critical

Actively exploited and high-impact — keep it off the public internet.

Default state

Older Elasticsearch exposed the transport protocol on 9300 with no authentication or TLS, so a host reaching 9300 could join or query the cluster. Modern versions enable security and bind privately.

What is port 9300 used for?

Port 9300 is the default for Elasticsearch's transport protocol, the internal binary channel that nodes use to talk to each other for cluster formation, shard replication, and internal queries. Unlike the client-facing HTTP/REST API on 9200, port 9300 is meant only for traffic between Elasticsearch nodes themselves. OpenSearch uses the same port for its node communication. Application clients normally never touch 9300 directly.

When would you open it?

Open 9300 only between the Elasticsearch nodes that form a cluster, so they can discover each other and replicate data across different hosts. You restrict it to the cluster members on a private network. If you run a single-node setup, it does not need to be reachable from anywhere else.

Is it safe to open?

Exposing 9300 is dangerous because a reachable transport port can let an outsider join the cluster or read its data. Keep it bound privately, enable node-to-node TLS and authentication, and firewall it to cluster members only. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :9300
nmap -p 9300 <target>
Windows
netstat -ano | findstr :9300
Test-NetConnection <host> -Port 9300
macOS
lsof -i :9300
nmap -p 9300 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 9300 to your device's local IP, internal port 9300, protocol TCP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 9300/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=9300/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 9300 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 9300" -Direction Inbound -Protocol TCP -LocalPort 9300 -Action Allow

Security & risks

Common attacks

  • Unauthenticated transport access to query or exfiltrate cluster data
  • Rogue nodes joining the cluster to read or manipulate indices
  • Version-specific scripting RCE such as the CVE-2015-1427 Groovy era
  • Information disclosure of cluster state and indexed documents

CVE-2015-1427

Hardening

  • Bind transport to a private interface (transport.host); never expose 9300 to the internet
  • Enable the security features (authentication and node-to-node TLS)
  • Firewall 9300 to cluster members only
  • Disable dynamic scripting on legacy versions and patch RCE bugs
  • Keep Elasticsearch patched and audit cluster membership

How to block this port

Linux (ufw)
sudo ufw deny 9300/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=9300/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 9300 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 9300" -Direction Inbound -Protocol TCP -LocalPort 9300 -Action Block

nmap snippet

nmap -p9300 --script banner <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 9200Port 5601Port 9092Port 6379

Frequently asked questions

What is the difference between Elasticsearch ports 9200 and 9300?
9200 is the HTTP/REST API used by clients, while 9300 is the binary transport protocol used for node-to-node and cluster communication. Both should be bound privately, secured with TLS and authentication, and firewalled.
Is it safe to expose Elasticsearch transport on port 9300?
No. Without security, a host reaching 9300 can join the cluster or query data, and legacy versions allowed scripting RCE (CVE-2015-1427). Bind transport privately, enable node-to-node TLS, and firewall the port.

Browse by category

Database ports

Related guides