Port 30303 Ethereum P2P · TCP and UDP

What runs on port 30303

Ethereum execution-client peer-to-peer port (Geth, Nethermind, Besu): TCP for peer connections and UDP for node discovery. A node needs it reachable to get good peers; the JSON-RPC API (8545) must not be exposed.

Software that uses it: Geth · Nethermind · Besu · Erigon

Should port 30303 be open?

Designed to face the internet. This port exists to be reachable from anywhere, so the usual question is not whether to open it but how the service behind it is configured and patched.

• Consensus clients use 9000 (Lighthouse, Nimbus) or 13000 (Prysm) for their own P2P.

Check port 30303

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :30303'
ss -lunp 'sport = :30303'
sudo lsof -i :30303

# from another machine: is it reachable?
nc -zv host 30303
nmap -p 30303 host
nc -zuv host 30303
sudo nmap -sU -p 30303 host
curl -v telnet://host:30303      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 30303

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 30303 proto tcp
sudo ufw allow from 10.0.0.0/8 to any port 30303 proto udp
sudo ufw deny 30303/tcp
sudo ufw deny 30303/udp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 meta l4proto { tcp, udp } th dport 30303 accept
nft add rule inet filter input meta l4proto { tcp, udp } th dport 30303 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 30303 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 30303 -j DROP
iptables -A INPUT -p udp --dport 30303 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 30303 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=30303 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 30303" with no source is just "open".

Related ports

• 8333 Bitcoin
• 9000 PHP-FPM / SonarQube / Portainer

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions