Port 8080 HTTP alt · TCP

What runs on port 8080

The most common alternative HTTP port: Tomcat, Jenkins, many Java and Go services, HTTP proxies (it is also the convention for a forward proxy), Docker containers mapped from port 80, and countless dev servers. It exists because binding ports below 1024 needed root on Unix. In production it should sit behind a reverse proxy or load balancer that terminates TLS on 443, and bind to a private address.

Software that uses it: Apache Tomcat · Jenkins · Jetty · Go/Java/Node services · Traefik dashboard (8080) · HTTP proxies · Docker port mappings

Should port 8080 be open?

Internet-facing only with authentication and care. It can be exposed when the service behind it is authenticated, rate-limited and kept up to date; most deployments are better off behind a VPN, an allow-list or a reverse proxy.

• curl -I http://host:8080/ and look at the Server header to identify it.
• nginx in front: proxy_pass http://127.0.0.1:8080; proxy_set_header Host $host; and X-Forwarded-Proto https so the app generates HTTPS links.
• For a Java app, 8080 answering on 0.0.0.0 usually also means JMX or an actuator endpoint nearby; check 8081/8090/9000 too.

Check port 8080

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :8080'
sudo lsof -i :8080

# from another machine: is it reachable?
nc -zv host 8080
nmap -p 8080 host
curl -v telnet://host:8080      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 8080

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 8080 proto tcp
sudo ufw deny 8080/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 8080 accept
nft add rule inet filter input tcp dport 8080 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=8080 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 8080" with no source is just "open".

Putting it behind nginx

server {
    listen 443 ssl;
    server_name app.example.com;
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

Then make the application listen on 127.0.0.1:8080 only. Test which location block a request hits with the nginx location tester.

Related ports

• 80 HTTP — Web, unencrypted
• 8443 HTTPS alt — Tomcat, Plesk, Unifi
• 8000 dev servers — Django, python -m http.server
• 8081 HTTP alt

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions