Port 5672: AMQP (RabbitMQ)

What uses port 5672

Applications publish and consume messages from RabbitMQ over AMQP 0-9-1 on port 5672 (5671 with TLS). ActiveMQ and Azure Service Bus speak AMQP 1.0 on the same port. RabbitMQ’s management UI is on 15672, and clustering uses 4369 and 25672.

Should port 5672 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

• RabbitMQ’s guest user can only connect from localhost. Create a dedicated user for remote apps instead of lifting that restriction.

Check what is listening on port 5672

sudo ss -ltnp 'sport = :5672'

sudo lsof -nP -iTCP:5672 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 5672 -State Listen
netstat -ano | findstr :5672

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 5672

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:5672 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 5672 -State Listen).OwningProcess

Allow port 5672 from trusted networks only

The examples allow 5672 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 5672 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 5672 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="5672" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "AMQP (RabbitMQ) 5672/TCP" -Direction Inbound -Protocol TCP -LocalPort 5672 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 5672 with Docker

# Publish on localhost only. Docker's port rules bypass ufw and firewalld,
# so -p 5672:5672 would expose the port to the whole network.
docker run -d -p 127.0.0.1:5672:5672 rabbitmq

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 5672 from another machine

nc -zv example.com 5672

Test-NetConnection example.com -Port 5672

Related ports

• Port 15672 (RabbitMQ management): the web UI and HTTP API of the RabbitMQ management plugin.
• Port 4369 (Erlang Port Mapper (epmd)): used by epmd, which lets Erlang nodes such as RabbitMQ find each other.
• Port 1883 (MQTT): the default port for MQTT, the publish/subscribe protocol for IoT.
• Port 9092 (Apache Kafka): the default broker port of Apache Kafka.

More messaging and queues ports

4222 (NATS) , 5060 (SIP) , 5222 (XMPP client) , 8883 (MQTT over TLS) . See all ports in the port lookup.

Sources

• IANA port registry: 5672

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions