Port 15672: RabbitMQ management

What uses port 15672

With the management plugin enabled (the rabbitmq:management Docker image has it), RabbitMQ serves a web dashboard and HTTP API on 15672 for inspecting queues, exchanges and connections. The default guest/guest login only works from localhost.

Should port 15672 be open to the internet?

Restrict access. Only open this port to known networks or users, for example your office IP, a VPN or behind authentication.

Check what is listening on port 15672

sudo ss -ltnp 'sport = :15672'

sudo lsof -nP -iTCP:15672 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 15672 -State Listen
netstat -ano | findstr :15672

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 15672

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:15672 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 15672 -State Listen).OwningProcess

Allow port 15672 from trusted networks only

The examples allow 15672 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 15672 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 15672 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="15672" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "RabbitMQ management 15672/TCP" -Direction Inbound -Protocol TCP -LocalPort 15672 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 15672 with Docker

# Publish on localhost only. Docker's port rules bypass ufw and firewalld,
# so -p 15672:15672 would expose the port to the whole network.
docker run -d -p 127.0.0.1:15672:15672 rabbitmq:management

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 15672 from another machine

nc -zv example.com 15672

Test-NetConnection example.com -Port 15672

Related ports

• Port 5672 (AMQP (RabbitMQ)): the AMQP port used by RabbitMQ and other message brokers.
• Port 4369 (Erlang Port Mapper (epmd)): used by epmd, which lets Erlang nodes such as RabbitMQ find each other.

More messaging and queues ports

1883 (MQTT) , 4222 (NATS) , 5060 (SIP) , 5222 (XMPP client) , 8883 (MQTT over TLS) , 9092 (Apache Kafka) . See all ports in the port lookup.

Sources

• IANA port registry (not registered for this use)

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions