Port 9200 — Elasticsearch

Q: How do I check if port 9200 is open?

Locally, sudo lsof -i :9200 on macOS or Linux, or netstat -ano | findstr :9200 on Windows. From outside, nc -zv host 9200 tells you whether anything answers.

TCP registered

What runs on port 9200

The Elasticsearch HTTP API.

The Elasticsearch HTTP API. Unauthenticated clusters exposed on this port have produced some of the largest data leaks on record, repeatedly, because the API allows reading and deleting every index with an ordinary HTTP request and no credentials. Security is enabled by default in current versions; the exposures come from old clusters and from tutorials that disable it to get started quickly.

Security considerations

Unauthenticated Elasticsearch clusters have caused some of the largest data leaks on record. Enable security and bind privately.

Checking whether something is listening

# Linux / macOS — what is bound to the port
sudo lsof -i :9200
sudo ss -lntp | grep :9200

# Windows
netstat -ano | findstr :9200
Get-NetTCPConnection -LocalPort 9200

# is it reachable from outside?
nc -zv example.com 9200
curl -v telnet://example.com:9200

Freeing the port

# find the process, then stop it
sudo lsof -ti :9200 | xargs kill        # Linux / macOS
netstat -ano | findstr :9200            # note the PID, then:
taskkill /PID <pid> /F                    # Windows

Should this port be open to the internet?

No. Port 9200 should never be reachable from a public address. Bind it to localhost or a private network, and reach it through a VPN or bastion host if remote access is genuinely needed. Internet-wide scanners find newly exposed instances of this service within minutes.

Opening or blocking port 9200

There is no blanket-allow rule on this page, because there is no case for one. Elasticsearch on port 9200 should be reachable from named addresses or not at all, so what follows restricts rather than opens:

# ufw — Debian, Ubuntu
sudo ufw allow from 10.0.0.0/8 to any port 9200 proto tcp
sudo ufw deny 9200/tcp                    # everything else

# firewalld — RHEL, Fedora, CentOS
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=9200 protocol=tcp accept'
sudo firewall-cmd --reload

# iptables, if you are still there
sudo iptables -A INPUT -p tcp --dport 9200 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 9200 -j DROP

# Windows
New-NetFirewallRule -DisplayName "Elasticsearch 9200" -Direction Inbound -Protocol TCP -LocalPort 9200 -RemoteAddress 10.0.0.0/8 -Action Allow

Change 10.0.0.0/8 to whatever your private range actually is. A firewall rule is the second line: the first is binding the service to a private interface, because a service that only listens on 127.0.0.1 cannot be reached however the firewall is configured.

Quick reference

Port	9200
Protocol	TCP
Service	Elasticsearch
Range	Registered (1024–49151) — any user process may bind

Frequently asked questions

What is port 9200 used for?

The Elasticsearch HTTP API.

Is it safe to open port 9200?

Unauthenticated Elasticsearch clusters have caused some of the largest data leaks on record. Enable security and bind privately.

How do I check if port 9200 is open?

Locally, sudo lsof -i :9200 on macOS or Linux, or netstat -ano | findstr :9200 on Windows. From outside, nc -zv host 9200 tells you whether anything answers.

Why do I get "address already in use" on port 9200?

Another process is bound to it — often a previous run of your own program that did not exit cleanly. Find it with lsof -ti :9200 and stop it, or configure your application to use a different port.

Can I change the port this service uses?

Almost always yes, in the service's configuration. Moving off a default port reduces automated scan noise, but it is obfuscation rather than security — a real attacker scans all 65,535.

Other common ports

All port numbers