Port 6379: Redis

What uses port 6379

Redis, and its open source fork Valkey, accept connections on 6379; Redis Sentinel uses 26379 and Redis Cluster bus ports are 10000 above the data port. Redis was designed for trusted networks: an exposed instance without a password can be used to write files on the server and take it over.

Should port 6379 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

• Since Redis 3.2, protected mode refuses remote connections when no password is set. Configure requirepass or ACL users and bind to private addresses instead of turning protected mode off.
• Managed Redis services (ElastiCache, Upstash, Azure Cache) often require TLS, sometimes on port 6380.

Check what is listening on port 6379

sudo ss -ltnp 'sport = :6379'

sudo lsof -nP -iTCP:6379 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 6379 -State Listen
netstat -ano | findstr :6379

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 6379

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:6379 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 6379 -State Listen).OwningProcess

Allow port 6379 from trusted networks only

The examples allow 6379 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 6379 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 6379 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="6379" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "Redis 6379/TCP" -Direction Inbound -Protocol TCP -LocalPort 6379 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 6379 with Docker

# Publish on localhost only. Docker's port rules bypass ufw and firewalld,
# so -p 6379:6379 would expose the port to the whole network.
docker run -d -p 127.0.0.1:6379:6379 redis

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 6379 from another machine

nc -zv example.com 6379

Test-NetConnection example.com -Port 6379

Related ports

• Port 11211 (Memcached): the default port for Memcached.
• Port 5432 (PostgreSQL): the default port for PostgreSQL.

More databases ports

1433 (Microsoft SQL Server) , 1434 (SQL Server Browser) , 1521 (Oracle Database) , 3306 (MySQL / MariaDB) , 8086 (InfluxDB) , 9042 (Cassandra / ScyllaDB) , 9200 (Elasticsearch / OpenSearch) , 9300 (Elasticsearch transport) . See all ports in the port lookup.

Sources

• IANA port registry: 6379

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions