Port 3000 dev servers · TCP

What runs on port 3000

The default port of an unusual number of development servers and self-hosted apps: Grafana, Rails, Next.js, Gitea, Create React App, Express examples, Rocket.Chat and many Node projects. On a laptop that is fine. On a server, a Node app on 3000 should sit behind a reverse proxy on 443 and bind to 127.0.0.1, not 0.0.0.0, which is the single most common misconfiguration in self-hosting guides.

Software that uses it: Grafana · Ruby on Rails · Next.js · Gitea/Forgejo · Rocket.Chat · Express/Node apps · Create React App

Should port 3000 be open?

Loopback or the host's own network only. The service should listen on 127.0.0.1 (or a Unix socket) and be reached by a reverse proxy or by the application on the same host. If it answers on a public address, that is a misconfiguration.

• ss -ltnp | grep :3000 shows which process has it and whether it listens on 0.0.0.0 or 127.0.0.1.
• Reverse-proxy with nginx: proxy_pass http://127.0.0.1:3000; and test the config with our nginx location tester.

Check port 3000

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :3000'
sudo lsof -i :3000

# from another machine: is it reachable?
nc -zv host 3000
nmap -p 3000 host
curl -v telnet://host:3000      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 3000

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 3000 proto tcp
sudo ufw deny 3000/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 3000 accept
nft add rule inet filter input tcp dport 3000 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 3000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=3000 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 3000" with no source is just "open".

Putting it behind nginx

server {
    listen 443 ssl;
    server_name app.example.com;
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

Then make the application listen on 127.0.0.1:3000 only. Test which location block a request hits with the nginx location tester.

Related ports

• 8080 HTTP alt — Tomcat, proxies, dev servers
• 5000 dev servers — Flask, Docker registry, UPnP
• 8000 dev servers — Django, python -m http.server
• 4000 dev servers — Phoenix, Jekyll

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions