Common Ports Used by ECSs

Common Ports

When adding a security group rule, you must specify ports or port ranges for communications. When a security group detects an access request, it checks whether the IP address and the port of the device that sends the request are allowed by the security group rules. Communications cannot be established unless the security group rules allow the request.

**Table 1** Common ports
Protocol	Port	Description
FTP	21	Used by FTP services for uploading and downloading files. For configuration examples, see Remotely Connecting to an ECS from a Local Server to Upload or Download Files over FTP.
SSH	22	Used to remotely connect to Linux ECSs. For configuration examples, see Remotely Logging In to an ECS from a Local Server. For details about how to log in to a Linux ECS, see Linux ECS Login Overview.
Telnet	23	Used to remotely log in to ECSs.
SMTP	25	Used to send emails. For security purposes, TCP port 25 is disabled in the outbound direction by default. For details about how to open the port, see Why Is Outbound Access Through TCP Port 25 Restricted?
HTTP	80	Used to access websites over HTTP. For configuration examples, see Setting Up a Website on an ECS to Provide Internet-Accessible Services.
POP3	110	Used to receive emails using Post Office Protocol version 3 (POP3).
IMAP	143	Used to receive emails using Internet Message Access Protocol (IMAP).
HTTPS	443	Used to access websites over HTTPS. For configuration examples, see Setting Up a Website on an ECS to Provide Internet-Accessible Services.
SQL Server	1433	A TCP port of the SQL Server for providing services. For configuration examples, see ECS Providing Database Access Service.
SQL Server	1434	A UDP port of the SQL Server for returning the TCP/IP port number used by the SQL Server. For configuration examples, see ECS Providing Database Access Service.
Oracle	1521	Used for Oracle database communications. This port must be enabled on the ECSs where Oracle SQL Server is deployed. For configuration examples, see ECS Providing Database Access Service.
MySQL	3306	Used by MySQL databases to provide services. For configuration examples, see ECS Providing Database Access Service.
Windows Server Remote Desktop Services	3389	Used to connect to Windows ECSs. For configuration examples, see Remotely Logging In to an ECS from a Local Server. For details about how to log in to a Windows ECS, see Windows ECS Login Overview.
Proxy	8080	Used by the WWW proxy service for web browsing, like port 80. If you use port 8080, you need to add :8080 after the IP address when you visit a website or use a proxy server. After Apache Tomcat is installed, the default service port is 8080.
NetBIOS	137, 138, and 139	NetBIOS is often used for Windows files, printer sharing, and Samba. Ports 137 and 138: UDP ports that are used when transferring files using Network Neighborhood (My Network Places). Port 139: Connections from this port try to access the NetBIOS/SMB service.

High-Risk Ports

When adding a security group rule, you must specify a port or port range for communications. Traffic is then allowed or denied if traffic matches this rule. Suppose a client requests to remotely log in to an ECS using SSH. When the request reaches the security group, the IP address and port of the client will be checked. If the IP address and the port match the allow rules in the security group, the request is allowed.

Table 2 lists some high-risk ports that are blocked by default. Even if you have added a security group rule to allow access over these ports, traffic over these ports in restricted regions is still denied. In this case, do not use these high-risk ports for your services.

**Table 2** High-risk ports
Protocol	Port
TCP	42, 135, 137, 138, 139, 444, 445, 593, 1025, 1068, 1433, 1434, 3127, 3128, 3129, 3130, 4444, 4789, 5554, 5800, 5900, 8998, and 9996
UDP	135 to 139, 1026, 1027, 1028, 1068, 1433, 1434, 4789, 5554, and 9996