Port 23 Telnet · TCP

What runs on port 23

Telnet: a remote terminal with no encryption at all; passwords are readable by anyone on the path. It survives on network equipment, industrial controllers and IoT devices, which is why Mirai-class botnets scan for it constantly. The protocol itself is also handy as a raw TCP client (telnet host 80) for poking at text protocols.

Software that uses it: telnetd (busybox, inetd) · Cisco/Juniper management (legacy)

Should port 23 be open?

Disable it. This is a legacy or insecure protocol. The recommendation is not to firewall it but to turn the service off and use the modern replacement.

• Use SSH; if a device only offers Telnet, put it on an isolated management VLAN.
• For testing a port by hand, nc or openssl s_client are the modern equivalents.

Check port 23

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :23'
sudo lsof -i :23

# from another machine: is it reachable?
nc -zv host 23
nmap -p 23 host
curl -v telnet://host:23      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 23

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 23 proto tcp
sudo ufw deny 23/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 23 accept
nft add rule inet filter input tcp dport 23 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 23 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 23 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=23 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 23" with no source is just "open".

Related ports

• 22 SSH — SSH, SCP, SFTP, git over ssh
• 513 rlogin / who — BSD r-commands; obsolete
• 514 syslog — Remote logging (tcp 514 is rsh/rlogin historically)

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions