Port 2222: SSH (alternate)

What uses port 2222

Admins often run a second SSH server, or the SSH server of a container or Git service (Gitea, GitLab in Docker), on port 2222 so it doesn’t clash with the host’s own sshd on 22. Connect with ssh -p 2222 user@host. Port 2222 isn’t officially assigned to SSH; it is just a convention.

Should port 2222 be open to the internet?

Restrict access. Only open this port to known networks or users, for example your office IP, a VPN or behind authentication.

• For Git over a non-standard port, use the URL form ssh://git@host:2222/owner/repo.git, because the git@host:path shorthand can’t include a port.

Check what is listening on port 2222

sudo ss -ltnp 'sport = :2222'

sudo lsof -nP -iTCP:2222 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 2222 -State Listen
netstat -ano | findstr :2222

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 2222

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:2222 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 2222 -State Listen).OwningProcess

Allow port 2222 from trusted networks only

The examples allow 2222 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 2222 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 2222 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="2222" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "SSH (alternate) 2222/TCP" -Direction Inbound -Protocol TCP -LocalPort 2222 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 2222 from another machine

nc -zv example.com 2222

Test-NetConnection example.com -Port 2222

Related ports

• Port 22 (SSH): used by SSH for secure remote logins, SFTP, SCP and Git over SSH.
• Port 3000 (Development server / Grafana): the default port of many development servers and of Grafana.

More remote access ports

23 (Telnet) , 1194 (OpenVPN) , 3389 (RDP) , 5900 (VNC) , 5985 (WinRM (HTTP)) , 5986 (WinRM (HTTPS)) , 51820 (WireGuard) . See all ports in the port lookup.

Sources

• IANA port registry (not registered for this use)

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions