Port 23 (Telnet): Uses and Security

What uses port 23

Telnet gives a remote command line like SSH, but sends everything, passwords included, in plain text. It survives on old network equipment, embedded devices and some industrial systems. Port 23 open on the internet is a red flag: IoT botnets such as Mirai spread by logging into Telnet with default passwords.

Should port 23 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

Replace Telnet with SSH wherever possible. If a device only supports Telnet, keep it on an isolated management network.
The telnet client is still handy for testing whether a TCP port is open: telnet host 443. nc -zv host 443 does the same.

Check what is listening on port 23

Linux

sudo ss -ltnp 'sport = :23'

macOS

sudo lsof -nP -iTCP:23 -sTCP:LISTEN

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 23 -State Listen
netstat -ano | findstr :23

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 23

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

macOS / Linux

sudo kill $(sudo lsof -t -iTCP:23 -sTCP:LISTEN)

Windows (PowerShell)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 23 -State Listen).OwningProcess

Allow port 23 from trusted networks only

The examples allow 23 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

Ubuntu / Debian (ufw)

sudo ufw allow from 10.0.0.0/8 to any port 23 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 23 proto tcp

RHEL / Fedora / Rocky (firewalld)

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="23" protocol="tcp" accept'
sudo firewall-cmd --reload

Windows (PowerShell, as administrator)

New-NetFirewallRule -DisplayName "Telnet 23/TCP" -Direction Inbound -Protocol TCP -LocalPort 23 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 23 from another machine

macOS / Linux

nc -zv example.com 23

Windows (PowerShell)

Test-NetConnection example.com -Port 23

Related ports

Port 22 (SSH): used by SSH for secure remote logins, SFTP, SCP and Git over SSH.
Port 3389 (RDP): used by RDP, Microsoft’s Remote Desktop Protocol.
Port 5900 (VNC): used by VNC for remote desktop access.

More remote access ports

1194 (OpenVPN) , 2222 (SSH (alternate)) , 5985 (WinRM (HTTP)) , 5986 (WinRM (HTTPS)) , 51820 (WireGuard) . See all ports in the port lookup.

Sources

IANA port registry: 23

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 23 used for?

Port 23 is used by Telnet, an old unencrypted remote terminal protocol. Telnet gives a remote command line like SSH, but sends everything, passwords included, in plain text. It survives on old network equipment, embedded devices and some industrial systems. Port 23 open on the internet is a red flag: IoT botnets such as Mirai spread by logging into Telnet with default passwords.

Is it safe to open port 23?

Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel. Allow it only from the networks that need it, as in the firewall examples on this page.

How do I check if port 23 is open?

On the server, list listening sockets with "sudo ss -ltnp 'sport = :23'" on Linux or "sudo lsof -nP -i :23" on macOS. From another machine, run "nc -zv host 23" or, on Windows, "Test-NetConnection host -Port 23". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.