Port 9090 Prometheus · TCP

What runs on port 9090

Prometheus' web UI and API: targets, alerts, and ad-hoc PromQL that returns every metric in the system. No authentication of its own, so reverse-proxy it or keep it internal. Also Cockpit's web console on Red Hat/Fedora (9090/TCP with TLS), Openfire's admin console and a few other admin UIs.

Software that uses it: Prometheus · Cockpit (Linux web console) · Openfire admin · Thanos Query (uses 9090 too)

Should port 9090 be open?

Private network or VPN only. Nothing good comes from this port being reachable from the internet. Keep it on an internal network, reach it over a VPN or an SSH tunnel, and firewall it from everything that does not need it.

• curl -s http://host:9090/-/healthy and /-/ready are the probes; /api/v1/targets lists what it scrapes.
• Exporters live on 9100 (node), 9104 (mysqld), 9187 (postgres), 9115 (blackbox) and so on; the "Default port allocations" page in the Prometheus wiki lists them.

Check port 9090

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :9090'
sudo lsof -i :9090

# from another machine: is it reachable?
nc -zv host 9090
nmap -p 9090 host
curl -v telnet://host:9090      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 9090

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 9090 proto tcp
sudo ufw deny 9090/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 9090 accept
nft add rule inet filter input tcp dport 9090 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 9090 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 9090 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=9090 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 9090" with no source is just "open".

Related ports

• 9093 Alertmanager
• 9100 JetDirect / node_exporter — Raw printing, Prometheus node exporter
• 3000 dev servers — Grafana, Rails, Node apps
• 8086 InfluxDB

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions