Port 1080 SOCKS · TCP

What runs on port 1080

SOCKS proxy: a generic TCP (and, in SOCKS5, UDP) relay with no understanding of the application protocol, so anything can go through it. ssh -D creates one on localhost, Tor exposes one on 9050, and many tools (curl, git, browsers) can be pointed at it. An open SOCKS proxy on the internet is a free anonymiser for abuse and is scanned for constantly.

Software that uses it: ssh -D (dynamic port forwarding) · Dante · microsocks · Shadowsocks · Tor (on 9050) · Burp/mitmproxy (SOCKS modes)

Should port 1080 be open?

Loopback or the host's own network only. The service should listen on 127.0.0.1 (or a Unix socket) and be reached by a reverse proxy or by the application on the same host. If it answers on a public address, that is a misconfiguration.

• curl --socks5-hostname localhost:1080 resolves DNS through the proxy too, which is what you usually want.
• Bind to 127.0.0.1 unless you really mean to share it.

Check port 1080

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :1080'
sudo lsof -i :1080

# from another machine: is it reachable?
nc -zv host 1080
nmap -p 1080 host
curl -v telnet://host:1080      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 1080

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 1080 proto tcp
sudo ufw deny 1080/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 1080 accept
nft add rule inet filter input tcp dport 1080 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 1080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 1080 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=1080 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 1080" with no source is just "open".

Related ports

• 3128 Squid proxy
• 9050 Tor SOCKS
• 22 SSH — SSH, SCP, SFTP, git over ssh

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions