Port 9200: Elasticsearch / OpenSearch

What uses port 9200

Applications, Kibana and Logstash talk to Elasticsearch and OpenSearch through the REST API on 9200; nodes communicate on 9300. Unprotected Elasticsearch clusters on the internet have caused some of the largest data leaks on record. Since 8.0, Elasticsearch enables authentication and TLS by default.

Should port 9200 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

• curl: (52) Empty reply from server on 9200 usually means the cluster expects HTTPS. Use https:// and the generated elastic password.

Check what is listening on port 9200

sudo ss -ltnp 'sport = :9200'

sudo lsof -nP -iTCP:9200 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 9200 -State Listen
netstat -ano | findstr :9200

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 9200

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:9200 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 9200 -State Listen).OwningProcess

Allow port 9200 from trusted networks only

The examples allow 9200 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 9200 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 9200 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="9200" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "Elasticsearch / OpenSearch 9200/TCP" -Direction Inbound -Protocol TCP -LocalPort 9200 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 9200 with Docker

# Publish on localhost only. Docker's port rules bypass ufw and firewalld,
# so -p 9200:9200 would expose the port to the whole network.
docker run -d -p 127.0.0.1:9200:9200 elasticsearch

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 9200 from another machine

nc -zv example.com 9200

Test-NetConnection example.com -Port 9200

Related ports

• Port 9300 (Elasticsearch transport): used for communication between Elasticsearch nodes.
• Port 5601 (Kibana): the default port of Kibana, the Elasticsearch dashboard.

More databases ports

1433 (Microsoft SQL Server) , 1434 (SQL Server Browser) , 1521 (Oracle Database) , 3306 (MySQL / MariaDB) , 5432 (PostgreSQL) , 6379 (Redis) , 8086 (InfluxDB) , 9042 (Cassandra / ScyllaDB) . See all ports in the port lookup.

Sources

• IANA port registry: 9200

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions