Port 9443 Portainer / HTTPS alt · TCP

What runs on port 9443

Another HTTPS alternative, now most associated with Portainer (its default since 2.9), plus various admin consoles (VMware, Sophos, HPE iLO in some modes). HTTPS, so identify the product from the certificate or the login page.

Software that uses it: Portainer · appliance admin interfaces

Should port 9443 be open?

Internet-facing only with authentication and care. It can be exposed when the service behind it is authenticated, rate-limited and kept up to date; most deployments are better off behind a VPN, an allow-list or a reverse proxy.

• Portainer on 9443 manages Docker; an exposed Portainer with a weak admin password is root on every host it manages.

Check port 9443

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :9443'
sudo lsof -i :9443

# from another machine: is it reachable?
nc -zv host 9443
nmap -p 9443 host
curl -v telnet://host:9443      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 9443

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 9443 proto tcp
sudo ufw deny 9443/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 9443 accept
nft add rule inet filter input tcp dport 9443 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 9443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 9443 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=9443 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 9443" with no source is just "open".

Putting it behind nginx

server {
    listen 443 ssl;
    server_name app.example.com;
    location / {
        proxy_pass http://127.0.0.1:9443;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

Then make the application listen on 127.0.0.1:9443 only. Test which location block a request hits with the nginx location tester.

Related ports

• 9000 PHP-FPM / SonarQube / Portainer
• 8443 HTTPS alt — Tomcat, Plesk, Unifi
• 2375 Docker API — Unencrypted; never expose

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions