Port 10250 (Kubelet API)

The kubelet API on every Kubernetes node: the API server uses it for logs, exec and port-forward.

Registered (user) port, 1024-49151 TCP Containers and Kubernetes Do not expose to the internet

What port 10250 is used for

The kubelet API on every Kubernetes node: the API server uses it for logs, exec and port-forward.

Security: should port 10250 be open?

Do not expose to the internet. Must never be reachable from the internet. With anonymous auth enabled, the kubelet lets anyone run commands in any pod on the node (exploited by TeamTNT and others). Set authentication.anonymous.enabled=false and authorization mode Webhook.

IANA assignment

Port 10250 is in the registered range and has no IANA assignment. The usage above is unofficial but widespread.

Check what is listening on port 10250

Linux: is anything listening on TCP 10250?

sudo ss -tlnp 'sport = :10250'

Linux / macOS: which process owns the port

sudo lsof -nP -i :10250

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':10250 '

Windows (Command Prompt)

netstat -ano | findstr :10250

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 10250 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 10250

From Windows

Test-NetConnection HOST -Port 10250

Block port 10250 in the firewall

ufw

sudo ufw deny 10250/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 10250 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 10250 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 10250' -Direction Inbound -Protocol TCP -LocalPort 10250 -Action Block

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.