Port 4222: NATS

What uses port 4222

NATS is a lightweight messaging system for microservices, with publish/subscribe, request/reply and persistent streams through JetStream. Clients connect on 4222; servers form clusters on 6222, and the HTTP monitoring endpoint is on 8222.

Should port 4222 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

Check what is listening on port 4222

sudo ss -ltnp 'sport = :4222'

sudo lsof -nP -iTCP:4222 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 4222 -State Listen
netstat -ano | findstr :4222

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 4222

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:4222 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 4222 -State Listen).OwningProcess

Allow port 4222 from trusted networks only

The examples allow 4222 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 4222 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 4222 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="4222" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "NATS 4222/TCP" -Direction Inbound -Protocol TCP -LocalPort 4222 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 4222 with Docker

# Publish on localhost only. Docker's port rules bypass ufw and firewalld,
# so -p 4222:4222 would expose the port to the whole network.
docker run -d -p 127.0.0.1:4222:4222 nats

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 4222 from another machine

nc -zv example.com 4222

Test-NetConnection example.com -Port 4222

Related ports

• Port 5672 (AMQP (RabbitMQ)): the AMQP port used by RabbitMQ and other message brokers.
• Port 9092 (Apache Kafka): the default broker port of Apache Kafka.

More messaging and queues ports

1883 (MQTT) , 4369 (Erlang Port Mapper (epmd)) , 5060 (SIP) , 5222 (XMPP client) , 8883 (MQTT over TLS) , 15672 (RabbitMQ management) . See all ports in the port lookup.

Sources

• IANA port registry (not registered for this use)

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions