DevToolsmith

Port 68: DHCP client

Port 68 (UDP) is the port DHCP clients use to receive IP address offers. It is a well-known port (0–1023). On Linux and macOS, binding to it needs root or the CAP_NET_BIND_SERVICE capability.

Service
DHCP client
Protocol
UDP
Range
Well-known (0–1023)
Official
IANA-registered
Exposure
Keep private
Category
Network services

What uses port 68

Devices send DHCP requests from UDP port 68 and receive the server’s replies on it. A host firewall that blocks incoming UDP 68 prevents the machine from getting or renewing an address automatically.

Should port 68 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

Check what is listening on port 68

Linux
sudo ss -lunp 'sport = :68'
macOS
sudo lsof -nP -iUDP:68
Windows (PowerShell)
Get-NetUDPEndpoint -LocalPort 68
netstat -ano | findstr :68

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Allow port 68 from trusted networks only

The examples allow 68 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

Ubuntu / Debian (ufw)
sudo ufw allow from 10.0.0.0/8 to any port 68 proto udp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 68 proto udp
RHEL / Fedora / Rocky (firewalld)
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="68" protocol="udp" accept'
sudo firewall-cmd --reload
Windows (PowerShell, as administrator)
New-NetFirewallRule -DisplayName "DHCP client 68/UDP" -Direction Inbound -Protocol UDP -LocalPort 68 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 68 from another machine

macOS / Linux
nc -zvu example.com 68   # UDP has no handshake, so "open" isn't conclusive

Related ports

  • Port 67 (DHCP server): where DHCP servers listen for requests from devices that need an IP address.
  • Port 53 (DNS): used by DNS to translate domain names into IP addresses.

More network services ports

88 (Kerberos) , 123 (NTP) , 135 (Microsoft RPC) , 137 (NetBIOS Name Service) , 179 (BGP) , 389 (LDAP) , 636 (LDAPS) , 853 (DNS over TLS) . See all ports in the port lookup.

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 68 used for?

Port 68 is the port DHCP clients use to receive IP address offers. Devices send DHCP requests from UDP port 68 and receive the server’s replies on it. A host firewall that blocks incoming UDP 68 prevents the machine from getting or renewing an address automatically.

Is it safe to open port 68?

Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel. Allow it only from the networks that need it, as in the firewall examples on this page.

How do I check if port 68 is open?

On the server, list listening sockets with "sudo ss -lunp 'sport = :68'" on Linux or "sudo lsof -nP -i :68" on macOS. From another machine, UDP has no handshake, so a port scan can’t reliably tell whether it is open; test with a real client for the service instead.