Port 5432: PostgreSQL

What uses port 5432

PostgreSQL servers listen on TCP 5432, and so do managed services such as Amazon RDS and Aurora PostgreSQL, Google Cloud SQL, Azure Database for PostgreSQL, Supabase and Neon. Connection poolers like PgBouncer commonly use 6432. Out of the box, PostgreSQL only listens on localhost.

Should port 5432 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

• Remote connections need two settings: listen_addresses = '*' (or a specific IP) in postgresql.conf, and a host line for the client network in pg_hba.conf. Reload PostgreSQL after changing them.
• no pg_hba.conf entry for host means the network reached PostgreSQL, but pg_hba.conf rejects that client, user or database.
• Keep 5432 off the public internet; bots constantly try default credentials such as postgres/postgres.

Check what is listening on port 5432

sudo ss -ltnp 'sport = :5432'

sudo lsof -nP -iTCP:5432 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 5432 -State Listen
netstat -ano | findstr :5432

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 5432

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:5432 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 5432 -State Listen).OwningProcess

Allow port 5432 from trusted networks only

The examples allow 5432 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 5432 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 5432 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="5432" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "PostgreSQL 5432/TCP" -Direction Inbound -Protocol TCP -LocalPort 5432 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 5432 with Docker

# Publish on localhost only. Docker's port rules bypass ufw and firewalld,
# so -p 5432:5432 would expose the port to the whole network.
docker run -d -p 127.0.0.1:5432:5432 postgres

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 5432 from another machine

nc -zv example.com 5432

Test-NetConnection example.com -Port 5432

Related ports

• Port 3306 (MySQL / MariaDB): the default port for MySQL and MariaDB.
• Port 6379 (Redis): the default port for Redis and Valkey.

More databases ports

1433 (Microsoft SQL Server) , 1434 (SQL Server Browser) , 1521 (Oracle Database) , 8086 (InfluxDB) , 9042 (Cassandra / ScyllaDB) , 9200 (Elasticsearch / OpenSearch) , 9300 (Elasticsearch transport) , 11211 (Memcached) . See all ports in the port lookup.

Sources

• IANA port registry: 5432

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions