Skip to content
ProtocolPorts

Port reference

Port 9418 (TCP) – Git protocol

The native Git transport (git://) served by git daemon — fast, unauthenticated, and unencrypted.

tcpRegistered

Quick facts

Transport
tcp
Category
Registered
Risk level
High

Frequently targeted — restrict exposure and harden it.

Default state

Open only where git daemon is explicitly run. Not enabled by default; sometimes left exposed on dev/CI servers.

What is port 9418 used for?

Port 9418 is the registered TCP port for the native Git protocol (git://), served by git daemon (git daemon). It is the fast, lightweight transport Git uses to clone and fetch repositories, separate from Git over SSH (port 22) and Git over HTTPS (443) used by GitHub, GitLab, and similar. The git:// URLs you occasionally see point here. It is not on by default and is started deliberately, usually on mirror, CI, or development servers for quick anonymous read access.

When would you open it?

Open or forward 9418 if you run git daemon to offer fast, public, read-only clones of repositories, for example a mirror server. Because it offers no authentication, only use it for content you are happy to share with anyone, and restrict it to trusted networks otherwise.

Is it safe to open?

The Git protocol is unauthenticated and unencrypted, so anyone who reaches it can clone what it serves and traffic is in cleartext. For anything private or writable, use SSH or HTTPS instead. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :9418
nmap -p 9418 <target>
Windows
netstat -ano | findstr :9418
Test-NetConnection <host> -Port 9418
macOS
lsof -i :9418
nmap -p 9418 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 9418 to your device's local IP, internal port 9418, protocol TCP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 9418/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=9418/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 9418 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 9418" -Direction Inbound -Protocol TCP -LocalPort 9418 -Action Allow

Security & risks

Common attacks

  • Anonymous cloning / source code theft from exposed repositories
  • Eavesdropping on cleartext repo data (no encryption or integrity)
  • Unintended exposure of private repos via export-all / loose config
  • Repository enumeration and information disclosure

Hardening

  • Disable git daemon; serve repos over SSH (22) or HTTPS instead
  • Never enable receive-pack (anonymous push) on a public daemon
  • Use export controls (no export-all) and explicit per-repo allowlists
  • Firewall TCP/9418; never expose it to the internet
  • Keep Git patched against transport/parsing CVEs

How to block this port

Linux (ufw)
sudo ufw deny 9418/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=9418/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 9418 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 9418" -Direction Inbound -Protocol TCP -LocalPort 9418 -Action Block

nmap snippet

nmap -p9418 --script banner <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 22Port 443Port 80Port 3690

Frequently asked questions

Is the git:// protocol on port 9418 secure?
No. The Git protocol is unauthenticated and unencrypted — anyone who can reach 9418 can read served repositories and traffic is in cleartext. Use SSH or HTTPS for any non-public or write access.
Should I expose port 9418 on the internet?
No. An exposed git daemon can leak source code and, if receive-pack is enabled, accept anonymous pushes. Disable it or restrict it to trusted networks and use authenticated SSH/HTTPS instead.

Related guides