Port 179 BGP · TCP

What runs on port 179

BGP: the routing protocol between autonomous systems, and also between routers inside large networks and in Kubernetes CNIs like Calico and in MetalLB. Sessions are TCP on 179 between explicitly configured peers; anything else connecting should be dropped. TCP-MD5 or TCP-AO authentication and the GTSM TTL hack protect the session itself.

Software that uses it: FRRouting · BIRD · GoBGP · Cisco/Juniper/Arista · Calico · MetalLB

Should port 179 be open?

Internet-facing only with authentication and care. It can be exposed when the service behind it is authenticated, rate-limited and kept up to date; most deployments are better off behind a VPN, an allow-list or a reverse proxy.

• A session stuck in Active or Connect usually means 179 is filtered one way or the peer address is wrong.
• Filter prefixes in both directions; a missing export filter is how route leaks happen.

Check port 179

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :179'
sudo lsof -i :179

# from another machine: is it reachable?
nc -zv host 179
nmap -p 179 host
curl -v telnet://host:179      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 179

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 179 proto tcp
sudo ufw deny 179/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 179 accept
nft add rule inet filter input tcp dport 179 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 179 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 179 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=179 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 179" with no source is just "open".

Related ports

• 22 SSH — SSH, SCP, SFTP, git over ssh
• 161 SNMP — Network monitoring

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions