Toolman 100% local

Port 9000 — PHP-FPM / SonarQube / Portainer

TCP registered

What runs on port 9000

Shared by several services — most commonly PHP-FPM, but also SonarQube and Portainer.

Heavily overloaded. PHP-FPM listens here for FastCGI, and so do SonarQube, Portainer and MinIO among others. The PHP-FPM case is the one that matters for security: the FastCGI protocol assumes it is only reachable from the web server, and an exposed PHP-FPM socket can be made to execute arbitrary files. It should be bound to localhost or, better, to a Unix socket.

Security considerations

PHP-FPM on 9000 must never be internet-reachable; it executes arbitrary scripts by design.

Checking whether something is listening

# Linux / macOS — what is bound to the port
sudo lsof -i :9000
sudo ss -lntp | grep :9000

# Windows
netstat -ano | findstr :9000
Get-NetTCPConnection -LocalPort 9000

# is it reachable from outside?
nc -zv example.com 9000
curl -v telnet://example.com:9000

Freeing the port

# find the process, then stop it
sudo lsof -ti :9000 | xargs kill        # Linux / macOS
netstat -ano | findstr :9000            # note the PID, then:
taskkill /PID <pid> /F                    # Windows

Should this port be open to the internet?

No. Port 9000 should never be reachable from a public address. Bind it to localhost or a private network, and reach it through a VPN or bastion host if remote access is genuinely needed. Internet-wide scanners find newly exposed instances of this service within minutes.

Opening or blocking port 9000

There is no blanket-allow rule on this page, because there is no case for one. PHP-FPM / SonarQube / Portainer on port 9000 should be reachable from named addresses or not at all, so what follows restricts rather than opens:

# ufw — Debian, Ubuntu
sudo ufw allow from 10.0.0.0/8 to any port 9000 proto tcp
sudo ufw deny 9000/tcp                    # everything else

# firewalld — RHEL, Fedora, CentOS
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=9000 protocol=tcp accept'
sudo firewall-cmd --reload

# iptables, if you are still there
sudo iptables -A INPUT -p tcp --dport 9000 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 9000 -j DROP

# Windows
New-NetFirewallRule -DisplayName "PHP-FPM / SonarQube / Portainer 9000" -Direction Inbound -Protocol TCP -LocalPort 9000 -RemoteAddress 10.0.0.0/8 -Action Allow

Change 10.0.0.0/8 to whatever your private range actually is. A firewall rule is the second line: the first is binding the service to a private interface, because a service that only listens on 127.0.0.1 cannot be reached however the firewall is configured.

Quick reference

Port9000
ProtocolTCP
ServicePHP-FPM / SonarQube / Portainer
RangeRegistered (1024–49151) — any user process may bind

Frequently asked questions

What is port 9000 used for?

Shared by several services — most commonly PHP-FPM, but also SonarQube and Portainer.

Is it safe to open port 9000?

PHP-FPM on 9000 must never be internet-reachable; it executes arbitrary scripts by design.

How do I check if port 9000 is open?

Locally, sudo lsof -i :9000 on macOS or Linux, or netstat -ano | findstr :9000 on Windows. From outside, nc -zv host 9000 tells you whether anything answers.

Why do I get "address already in use" on port 9000?

Another process is bound to it — often a previous run of your own program that did not exit cleanly. Find it with lsof -ti :9000 and stop it, or configure your application to use a different port.

Can I change the port this service uses?

Almost always yes, in the service's configuration. Moving off a default port reduces automated scan noise, but it is obfuscation rather than security — a real attacker scans all 65,535.

Other common ports

All port numbers