Port 69 TFTP · UDP

What runs on port 69

TFTP: trivial file transfer over UDP, with no authentication and no directory listing. It is how PXE boot loads a kernel, how switches and phones fetch firmware and configs, and how a lot of network gear still backs up its configuration. The request goes to port 69; the transfer continues from a random port, which confuses stateful firewalls without a TFTP helper.

Software that uses it: tftpd-hpa · atftpd · dnsmasq (built-in TFTP) · PXE/iPXE

Should port 69 be open?

Private network or VPN only. Nothing good comes from this port being reachable from the internet. Keep it on an internal network, reach it over a VPN or an SSH tunnel, and firewall it from everything that does not need it.

• Serve from a dedicated read-only directory; anyone who can reach the port can read every file.
• For PXE, the DHCP options next-server and filename point clients at the TFTP server.

Check port 69

# on the host: is anything listening, and which process?
ss -lunp 'sport = :69'
sudo lsof -i :69

# from another machine: is it reachable?
nc -zuv host 69
sudo nmap -sU -p 69 host

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 69

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 69 proto udp
sudo ufw deny 69/udp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 udp dport 69 accept
nft add rule inet filter input udp dport 69 drop

# iptables (legacy)
iptables -A INPUT -p udp --dport 69 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 69 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=69 protocol=udp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 69" with no source is just "open".

Related ports

• 67 DHCP server — Hands out IP addresses
• 21 FTP — FTP control; plaintext, replace with SFTP
• 4011 PXE proxyDHCP

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions