Port 32400 Plex · TCP

What runs on port 32400

Plex Media Server. Remote access forwards 32400 to the server; the Plex relay is used when that fails. Plex authenticates every request through plex.tv tokens, so an exposed 32400 is designed for, but the server has had remote vulnerabilities and runs with access to your media library; keep it updated and consider a VPN or Tailscale instead of a port forward.

Software that uses it: Plex Media Server · Jellyfin uses 8096/8920, Emby 8096

Should port 32400 be open?

Internet-facing only with authentication and care. It can be exposed when the service behind it is authenticated, rate-limited and kept up to date; most deployments are better off behind a VPN, an allow-list or a reverse proxy.

• Settings → Remote Access shows whether the forward works; "Not available outside your network" means the port is not reachable.

Check port 32400

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :32400'
sudo lsof -i :32400

# from another machine: is it reachable?
nc -zv host 32400
nmap -p 32400 host
curl -v telnet://host:32400      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 32400

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 32400 proto tcp
sudo ufw deny 32400/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 32400 accept
nft add rule inet filter input tcp dport 32400 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 32400 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 32400 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=32400 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 32400" with no source is just "open".

Related ports

• 1900 SSDP / UPnP
• 8200 Vault

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions