Port 3000 (Grafana / development servers)

Default port of Grafana, and of many dev servers: Create React App, Next.js, Express, Rails (rails server) and Gitea.

Registered (user) port, 1024-49151 TCP Development tools Expose only to trusted sources

What port 3000 is used for

Default port of Grafana, and of many dev servers: Create React App, Next.js, Express, Rails (rails server) and Gitea.

Security: should port 3000 be open?

Expose only to trusted sources. Dev servers are not built for the internet; keep them on localhost. For Grafana, change the default admin/admin password, disable sign-up and keep it patched (path traversal CVE-2021-43798).

IANA assignment

Service nameProtoDescriptionAssigneeReference

hbci TCP HBCI Kurt Haubner -

remoteware-cl TCP RemoteWare Client
This entry records an unassigned but widespread use Tim Farley -

hbci UDP HBCI Kurt Haubner -

remoteware-cl UDP RemoteWare Client
This entry records an unassigned but widespread use Tim Farley -

Check what is listening on port 3000

Linux: is anything listening on TCP 3000?

sudo ss -tlnp 'sport = :3000'

Linux / macOS: which process owns the port

sudo lsof -nP -i :3000

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':3000 '

Windows (Command Prompt)

netstat -ano | findstr :3000

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 3000 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 3000

From Windows

Test-NetConnection HOST -Port 3000

Allow only trusted sources on port 3000 in the firewall

Replace 203.0.113.10 with the address or network you trust. With ufw, make sure the default incoming policy is deny.

ufw (one trusted source)

sudo ufw allow from 203.0.113.10 to any port 3000 proto tcp

iptables

sudo iptables -A INPUT -p tcp --dport 3000 -s 203.0.113.10 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 3000 -j DROP

nftables

sudo nft add rule inet filter input ip saddr 203.0.113.10 tcp dport 3000 accept
sudo nft add rule inet filter input tcp dport 3000 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'TCP 3000 trusted' -Direction Inbound -Protocol TCP -LocalPort 3000 -RemoteAddress 203.0.113.10 -Action Allow

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.