Port 67 DHCP server · UDP

What runs on port 67

DHCP server side. Clients broadcast from port 68 to port 67 to get an address, gateway, DNS servers and other options; the exchange is DISCOVER, OFFER, REQUEST, ACK. It is link-local by nature, which is why a DHCP relay (ip helper-address) is needed to serve other subnets.

Software that uses it: ISC Kea · ISC DHCP (dhcpd) · dnsmasq · Windows DHCP Server · router firmware

Should port 67 be open?

Private network or VPN only. Nothing good comes from this port being reachable from the internet. Keep it on an internal network, reach it over a VPN or an SSH tunnel, and firewall it from everything that does not need it.

• Two DHCP servers on one segment (a rogue router, a VM host) cause the classic intermittent-wrong-gateway problem; DHCP snooping on switches prevents it.
• Leases, not clients, are what you manage: check the lease file when an address is "in use".

Check port 67

# on the host: is anything listening, and which process?
ss -lunp 'sport = :67'
sudo lsof -i :67

# from another machine: is it reachable?
nc -zuv host 67
sudo nmap -sU -p 67 host

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 67

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 67 proto udp
sudo ufw deny 67/udp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 udp dport 67 accept
nft add rule inet filter input udp dport 67 drop

# iptables (legacy)
iptables -A INPUT -p udp --dport 67 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 67 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=67 protocol=udp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 67" with no source is just "open".

Related ports

• 68 DHCP client
• 69 TFTP — Trivial file transfer (PXE boot, network gear)
• 53 DNS — Domain name resolution; TCP for large answers and zone transfers

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions