DevToolsmith

Port 9300: Elasticsearch transport

Port 9300 (TCP) is used for communication between Elasticsearch nodes. It is a registered port (1024–49151), so any user can listen on it.

Service
Elasticsearch transport
Protocol
TCP
Range
Registered (1024–49151)
Official
Common convention
Exposure
Keep private
Category
Databases

What uses port 9300

Elasticsearch and OpenSearch nodes join the cluster and replicate shards over the transport protocol on 9300. Only cluster nodes need it; clients use the HTTP API on 9200.

Should port 9300 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

Check what is listening on port 9300

Linux
sudo ss -ltnp 'sport = :9300'
macOS
sudo lsof -nP -iTCP:9300 -sTCP:LISTEN
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 9300 -State Listen
netstat -ano | findstr :9300

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 9300

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

macOS / Linux
sudo kill $(sudo lsof -t -iTCP:9300 -sTCP:LISTEN)
Windows (PowerShell)
Stop-Process -Id (Get-NetTCPConnection -LocalPort 9300 -State Listen).OwningProcess

Allow port 9300 from trusted networks only

The examples allow 9300 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

Ubuntu / Debian (ufw)
sudo ufw allow from 10.0.0.0/8 to any port 9300 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 9300 proto tcp
RHEL / Fedora / Rocky (firewalld)
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="9300" protocol="tcp" accept'
sudo firewall-cmd --reload
Windows (PowerShell, as administrator)
New-NetFirewallRule -DisplayName "Elasticsearch transport 9300/TCP" -Direction Inbound -Protocol TCP -LocalPort 9300 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 9300 from another machine

macOS / Linux
nc -zv example.com 9300
Windows (PowerShell)
Test-NetConnection example.com -Port 9300

Related ports

  • Port 9200 (Elasticsearch / OpenSearch): the HTTP API port of Elasticsearch and OpenSearch.
  • Port 5601 (Kibana): the default port of Kibana, the Elasticsearch dashboard.

More databases ports

1433 (Microsoft SQL Server) , 1434 (SQL Server Browser) , 1521 (Oracle Database) , 3306 (MySQL / MariaDB) , 5432 (PostgreSQL) , 6379 (Redis) , 8086 (InfluxDB) , 9042 (Cassandra / ScyllaDB) . See all ports in the port lookup.

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 9300 used for?

Port 9300 is used for communication between Elasticsearch nodes. Elasticsearch and OpenSearch nodes join the cluster and replicate shards over the transport protocol on 9300. Only cluster nodes need it; clients use the HTTP API on 9200.

Is it safe to open port 9300?

Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel. Allow it only from the networks that need it, as in the firewall examples on this page.

How do I check if port 9300 is open?

On the server, list listening sockets with "sudo ss -ltnp 'sport = :9300'" on Linux or "sudo lsof -nP -i :9300" on macOS. From another machine, run "nc -zv host 9300" or, on Windows, "Test-NetConnection host -Port 9300". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.