Port 3000: Development server / Grafana

What uses port 3000

Node.js frameworks such as Next.js, Nuxt, Create React App and many Express examples default to port 3000, as do Ruby on Rails and Grafana. Gitea uses it too. In production, these apps usually sit behind a reverse proxy that serves 80 and 443, and port 3000 stays bound to localhost.

Should port 3000 be open to the internet?

Restrict access. Only open this port to known networks or users, for example your office IP, a VPN or behind authentication.

• EADDRINUSE: address already in use :::3000 means another dev server is still running, often in another terminal. Kill it (npx kill-port 3000 or lsof -ti :3000 | xargs kill) or start on another port with PORT=3001.
• Grafana’s default login is admin/admin. Change it before exposing Grafana anywhere.

Check what is listening on port 3000

sudo ss -ltnp 'sport = :3000'

sudo lsof -nP -iTCP:3000 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 3000 -State Listen
netstat -ano | findstr :3000

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 3000

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:3000 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 3000 -State Listen).OwningProcess

Allow port 3000 from trusted networks only

The examples allow 3000 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 3000 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 3000 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="3000" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "Development server / Grafana 3000/TCP" -Direction Inbound -Protocol TCP -LocalPort 3000 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 3000 with Docker

# Publish on localhost only. Docker's port rules bypass ufw and firewalld,
# so -p 3000:3000 would expose the port to the whole network.
docker run -d -p 127.0.0.1:3000:3000 grafana/grafana

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 3000 from another machine

nc -zv example.com 3000

Test-NetConnection example.com -Port 3000

Related ports

• Port 8080 (HTTP alternate): the most common alternate HTTP port, used by proxies, app servers and dev tools.
• Port 5173 (Vite dev server): the default port of the Vite development server.
• Port 8000 (Development server (Django, Python)): a common port for development servers, including Django and Python’s http.server.
• Port 4200 (Angular dev server): the default port of the Angular CLI development server.

More development servers ports

5000 (Flask / development servers) , 8888 (Jupyter) , 9000 (PHP-FPM / MinIO / SonarQube) , 9418 (Git protocol) . See all ports in the port lookup.

Sources

• IANA port registry (not registered for this use)

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions