What uses port 135
Windows services such as WMI, DCOM, Active Directory replication and remote management first contact the endpoint mapper on port 135 to find out which dynamic high port (49152–65535) the actual service is using. Blocking 135 between Windows machines breaks these features; exposing it to the internet invites exploitation.
Should port 135 be open to the internet?
Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.
Check what is listening on port 135
sudo ss -ltnp 'sport = :135'sudo lsof -nP -iTCP:135 -sTCP:LISTENGet-NetTCPConnection -LocalPort 135 -State Listen
netstat -ano | findstr :135No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.
Fix “address already in use” on port 135
Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:
sudo kill $(sudo lsof -t -iTCP:135 -sTCP:LISTEN)Stop-Process -Id (Get-NetTCPConnection -LocalPort 135 -State Listen).OwningProcessAllow port 135 from trusted networks only
The examples allow 135 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.
sudo ufw allow from 10.0.0.0/8 to any port 135 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 135 proto tcpsudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="135" protocol="tcp" accept'
sudo firewall-cmd --reloadNew-NetFirewallRule -DisplayName "Microsoft RPC 135/TCP" -Direction Inbound -Protocol TCP -LocalPort 135 -Action Allow -RemoteAddress 10.0.0.0/8On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.
Test port 135 from another machine
nc -zv example.com 135Test-NetConnection example.com -Port 135Related ports
- Port 445 (SMB): used by SMB for Windows file and printer sharing.
- Port 139 (NetBIOS Session): used by NetBIOS session service, the legacy transport for Windows file sharing.
- Port 3389 (RDP): used by RDP, Microsoft’s Remote Desktop Protocol.
- Port 5985 (WinRM (HTTP)): used by Windows Remote Management over HTTP, including PowerShell remoting.
More network services ports
53 (DNS) , 67 (DHCP server) , 68 (DHCP client) , 88 (Kerberos) , 123 (NTP) , 137 (NetBIOS Name Service) , 179 (BGP) , 389 (LDAP) . See all ports in the port lookup.
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What is port 135 used for?
Port 135 is the Microsoft RPC endpoint mapper, used by many Windows services. Windows services such as WMI, DCOM, Active Directory replication and remote management first contact the endpoint mapper on port 135 to find out which dynamic high port (49152–65535) the actual service is using. Blocking 135 between Windows machines breaks these features; exposing it to the internet invites exploitation.
Is it safe to open port 135?
Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel. Allow it only from the networks that need it, as in the firewall examples on this page.
How do I check if port 135 is open?
On the server, list listening sockets with "sudo ss -ltnp 'sport = :135'" on Linux or "sudo lsof -nP -i :135" on macOS. From another machine, run "nc -zv host 135" or, on Windows, "Test-NetConnection host -Port 135". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.