Port 3269: Global Catalog over TLS

What uses port 3269

Port 3269 is the encrypted counterpart of 3268: LDAP over TLS queries against the forest-wide Global Catalog. Use it when an application authenticates users from several domains and must protect bind passwords.

Should port 3269 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

Check what is listening on port 3269

sudo ss -ltnp 'sport = :3269'

sudo lsof -nP -iTCP:3269 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 3269 -State Listen
netstat -ano | findstr :3269

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 3269

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:3269 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 3269 -State Listen).OwningProcess

Allow port 3269 from trusted networks only

The examples allow 3269 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 3269 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 3269 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="3269" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "Global Catalog over TLS 3269/TCP" -Direction Inbound -Protocol TCP -LocalPort 3269 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 3269 from another machine

nc -zv example.com 3269

Test-NetConnection example.com -Port 3269

Related ports

• Port 3268 (Active Directory Global Catalog): used by the Active Directory Global Catalog for forest-wide LDAP searches.
• Port 636 (LDAPS): used by LDAP over TLS (LDAPS) for encrypted directory access.
• Port 389 (LDAP): used by LDAP for directory lookups and authentication, including Active Directory.

More network services ports

53 (DNS) , 67 (DHCP server) , 68 (DHCP client) , 88 (Kerberos) , 123 (NTP) , 135 (Microsoft RPC) , 137 (NetBIOS Name Service) , 179 (BGP) . See all ports in the port lookup.

Sources

• IANA port registry: 3269

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions