DevToolsmith

Port 67: DHCP server

Port 67 (UDP) is where DHCP servers listen for requests from devices that need an IP address. It is a well-known port (0–1023). On Linux and macOS, binding to it needs root or the CAP_NET_BIND_SERVICE capability.

Service
DHCP server
Protocol
UDP
Range
Well-known (0–1023)
Official
IANA-registered
Exposure
Keep private
Category
Network services

What uses port 67

When a device joins a network, it broadcasts a DHCP discover message from UDP port 68 to port 67. The DHCP server (usually the router) replies with an offer containing an IP address, subnet mask, gateway and DNS servers. DHCP only works within a local network segment unless a relay agent forwards it.

Should port 67 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

  • Two DHCP servers on one network (a second router, a misconfigured VM host) hand out conflicting addresses. If devices get unexpected IPs, look for a rogue DHCP server.

Check what is listening on port 67

Linux
sudo ss -lunp 'sport = :67'
macOS
sudo lsof -nP -iUDP:67
Windows (PowerShell)
Get-NetUDPEndpoint -LocalPort 67
netstat -ano | findstr :67

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Allow port 67 from trusted networks only

The examples allow 67 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

Ubuntu / Debian (ufw)
sudo ufw allow from 10.0.0.0/8 to any port 67 proto udp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 67 proto udp
RHEL / Fedora / Rocky (firewalld)
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="67" protocol="udp" accept'
sudo firewall-cmd --reload
Windows (PowerShell, as administrator)
New-NetFirewallRule -DisplayName "DHCP server 67/UDP" -Direction Inbound -Protocol UDP -LocalPort 67 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 67 from another machine

macOS / Linux
nc -zvu example.com 67   # UDP has no handshake, so "open" isn't conclusive

Related ports

  • Port 68 (DHCP client): the port DHCP clients use to receive IP address offers.
  • Port 53 (DNS): used by DNS to translate domain names into IP addresses.
  • Port 69 (TFTP): used by TFTP, a minimal file transfer protocol for network booting and device firmware.

More network services ports

88 (Kerberos) , 123 (NTP) , 135 (Microsoft RPC) , 137 (NetBIOS Name Service) , 179 (BGP) , 389 (LDAP) , 636 (LDAPS) , 853 (DNS over TLS) . See all ports in the port lookup.

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 67 used for?

Port 67 is where DHCP servers listen for requests from devices that need an IP address. When a device joins a network, it broadcasts a DHCP discover message from UDP port 68 to port 67. The DHCP server (usually the router) replies with an offer containing an IP address, subnet mask, gateway and DNS servers. DHCP only works within a local network segment unless a relay agent forwards it.

Is it safe to open port 67?

Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel. Allow it only from the networks that need it, as in the firewall examples on this page.

How do I check if port 67 is open?

On the server, list listening sockets with "sudo ss -lunp 'sport = :67'" on Linux or "sudo lsof -nP -i :67" on macOS. From another machine, UDP has no handshake, so a port scan can’t reliably tell whether it is open; test with a real client for the service instead.