Port 9092 Kafka · TCP

What runs on port 9092

Apache Kafka broker port (PLAINTEXT listener). Kafka's "advertised.listeners" is the setting behind most connection problems: the broker tells clients which address to use for the follow-up connections, and if that is an internal hostname, external clients get the first connection and then time out. 9093 is the usual TLS listener; KRaft controllers use 9093 or 9094 too.

Software that uses it: Apache Kafka · Confluent Platform · Redpanda (same port) · Amazon MSK, Aiven, Confluent Cloud

Should port 9092 be open?

Private network or VPN only. Nothing good comes from this port being reachable from the internet. Keep it on an internal network, reach it over a VPN or an SSH tunnel, and firewall it from everything that does not need it.

• kafkacat/kcat -L -b host:9092 lists topics and the advertised listeners the broker hands out.
• Use SASL and TLS (9093) for anything outside the cluster network; PLAINTEXT 9092 is for the VPC only.

Check port 9092

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :9092'
sudo lsof -i :9092

# from another machine: is it reachable?
nc -zv host 9092
nmap -p 9092 host
curl -v telnet://host:9092      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 9092

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 9092 proto tcp
sudo ufw deny 9092/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 9092 accept
nft add rule inet filter input tcp dport 9092 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 9092 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 9092 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=9092 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 9092" with no source is just "open".

Related ports

• 2181 ZooKeeper — Client port
• 9093 Alertmanager
• 8081 HTTP alt
• 5672 AMQP — RabbitMQ

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions