Port 6379 Redis · TCP

What runs on port 6379

Redis (and Valkey, KeyDB, Dragonfly). The protocol is plaintext with no authentication unless requirepass or ACLs are set, and older versions let an unauthenticated client write the RDB file to disk, which was used to drop SSH keys and cron jobs on thousands of servers. Since 3.2 Redis refuses external connections in "protected mode" without a password; it still belongs on localhost or a private network with TLS (6.0+) and ACLs.

Software that uses it: Redis · Valkey · KeyDB · Dragonfly · ElastiCache, Memorystore, Upstash · Sentinel (26379), Cluster bus (16379)

Should port 6379 be open?

Loopback or the host's own network only. The service should listen on 127.0.0.1 (or a Unix socket) and be reached by a reverse proxy or by the application on the same host. If it answers on a public address, that is a misconfiguration.

• redis-cli -h host ping from another machine: PONG without AUTH means it is open.
• bind 127.0.0.1 ::1, requirepass, and rename-command FLUSHALL "" are the classic hardening lines.

Check port 6379

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :6379'
sudo lsof -i :6379

# from another machine: is it reachable?
nc -zv host 6379
nmap -p 6379 host
curl -v telnet://host:6379      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 6379

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 6379 proto tcp
sudo ufw deny 6379/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 6379 accept
nft add rule inet filter input tcp dport 6379 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 6379 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 6379 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=6379 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 6379" with no source is just "open".

Related ports

• 11211 Memcached — Never expose; UDP used in amplification attacks
• 27017 MongoDB
• 5432 PostgreSQL

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions