Port 2380 (etcd peer): Uses and Security

What uses port 2380

etcd nodes run Raft consensus with each other over port 2380. In a Kubernetes control plane with three or five etcd members, all members must reach each other on 2380 with low latency; slow disks or networks show up as leader elections and API timeouts.

Should port 2380 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

Check what is listening on port 2380

Linux

sudo ss -ltnp 'sport = :2380'

macOS

sudo lsof -nP -iTCP:2380 -sTCP:LISTEN

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 2380 -State Listen
netstat -ano | findstr :2380

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 2380

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

macOS / Linux

sudo kill $(sudo lsof -t -iTCP:2380 -sTCP:LISTEN)

Windows (PowerShell)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 2380 -State Listen).OwningProcess

Allow port 2380 from trusted networks only

The examples allow 2380 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

Ubuntu / Debian (ufw)

sudo ufw allow from 10.0.0.0/8 to any port 2380 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 2380 proto tcp

RHEL / Fedora / Rocky (firewalld)

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="2380" protocol="tcp" accept'
sudo firewall-cmd --reload

Windows (PowerShell, as administrator)

New-NetFirewallRule -DisplayName "etcd peer 2380/TCP" -Direction Inbound -Protocol TCP -LocalPort 2380 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 2380 from another machine

macOS / Linux

nc -zv example.com 2380

Windows (PowerShell)

Test-NetConnection example.com -Port 2380

Related ports

Port 2379 (etcd client): the etcd client API port, used by the Kubernetes API server.
Port 6443 (Kubernetes API server): the default port of the Kubernetes API server.

More containers and orchestration ports

2375 (Docker API (unencrypted)) , 2376 (Docker API (TLS)) , 10250 (Kubelet API) . See all ports in the port lookup.

Sources

IANA port registry: 2380

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 2380 used for?

Port 2380 is used for replication between etcd cluster members. etcd nodes run Raft consensus with each other over port 2380. In a Kubernetes control plane with three or five etcd members, all members must reach each other on 2380 with low latency; slow disks or networks show up as leader elections and API timeouts.

Is it safe to open port 2380?

Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel. Allow it only from the networks that need it, as in the firewall examples on this page.

How do I check if port 2380 is open?

On the server, list listening sockets with "sudo ss -ltnp 'sport = :2380'" on Linux or "sudo lsof -nP -i :2380" on macOS. From another machine, run "nc -zv host 2380" or, on Windows, "Test-NetConnection host -Port 2380". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.