Port 6881 BitTorrent · TCP and UDP

What runs on port 6881

BitTorrent's traditional port range, 6881–6889 (TCP for peers, UDP for DHT and uTP). Most clients now pick a random high port, and many ISPs throttle this range specifically, so seeing it is a sign of an older or default-configured client. For a Linux distribution mirror or a Resilio/Syncthing-like setup, the port needs to be forwarded for others to connect in.

Software that uses it: qBittorrent, Transmission, Deluge, rTorrent · Resilio Sync (different port) · libtorrent-based apps

Should port 6881 be open?

Designed to face the internet. This port exists to be reachable from anywhere, so the usual question is not whether to open it but how the service behind it is configured and patched.

• A "connectable" client needs the port forwarded (or UPnP); otherwise you can only connect out.
• Encryption in BitTorrent clients obfuscates rather than secures; use a VPN if privacy is the goal.

Check port 6881

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :6881'
ss -lunp 'sport = :6881'
sudo lsof -i :6881

# from another machine: is it reachable?
nc -zv host 6881
nmap -p 6881 host
nc -zuv host 6881
sudo nmap -sU -p 6881 host
curl -v telnet://host:6881      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 6881

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 6881 proto tcp
sudo ufw allow from 10.0.0.0/8 to any port 6881 proto udp
sudo ufw deny 6881/tcp
sudo ufw deny 6881/udp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 meta l4proto { tcp, udp } th dport 6881 accept
nft add rule inet filter input meta l4proto { tcp, udp } th dport 6881 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 6881 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 6881 -j DROP
iptables -A INPUT -p udp --dport 6881 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 6881 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=6881 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 6881" with no source is just "open".

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions