Port 5269 XMPP server-to-server · TCP

What runs on port 5269

XMPP server-to-server federation: how users on different XMPP domains talk to each other. Both servers need it reachable; DNS SRV records point to it.

Software that uses it: ejabberd · Prosody · Openfire

Should port 5269 be open?

Designed to face the internet. This port exists to be reachable from anywhere, so the usual question is not whether to open it but how the service behind it is configured and patched.

• Use the XMPP compliance tester (compliance.conversations.im) to check TLS and SRV setup.

Check port 5269

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :5269'
sudo lsof -i :5269

# from another machine: is it reachable?
nc -zv host 5269
nmap -p 5269 host
curl -v telnet://host:5269      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 5269

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 5269 proto tcp
sudo ufw deny 5269/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 5269 accept
nft add rule inet filter input tcp dport 5269 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 5269 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 5269 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=5269 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 5269" with no source is just "open".

Related ports

• 5222 XMPP client

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions