Port 30000 (Kubernetes NodePort range)

Start of the default Kubernetes NodePort range (30000-32767), where NodePort services are exposed on every node.

Registered (user) port, 1024-49151 TCPUDP Containers and Kubernetes Expose only to trusted sources

What port 30000 is used for

Start of the default Kubernetes NodePort range (30000-32767), where NodePort services are exposed on every node.

Security: should port 30000 be open?

Expose only to trusted sources. Every NodePort is open on every node's IP. Use LoadBalancer or Ingress for public services and firewall the range from the internet.

IANA assignment

Service nameProtoDescriptionAssigneeReference

ndmps TCP Secure Network Data Management Protocol Alioune Thiam -

Registry dates for this port: registered 2013-02-05.

Check what is listening on port 30000

Linux: is anything listening on TCP 30000?

sudo ss -tlnp 'sport = :30000'

Linux: UDP 30000

sudo ss -ulnp 'sport = :30000'

Linux / macOS: which process owns the port

sudo lsof -nP -i :30000

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':30000 '

Windows (Command Prompt)

netstat -ano | findstr :30000

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 30000 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 30000

From Windows

Test-NetConnection HOST -Port 30000

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 30000

Allow only trusted sources on port 30000 in the firewall

Replace 203.0.113.10 with the address or network you trust. With ufw, make sure the default incoming policy is deny.

ufw (one trusted source)

sudo ufw allow from 203.0.113.10 to any port 30000 proto tcp

iptables

sudo iptables -A INPUT -p tcp --dport 30000 -s 203.0.113.10 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 30000 -j DROP

nftables

sudo nft add rule inet filter input ip saddr 203.0.113.10 tcp dport 30000 accept
sudo nft add rule inet filter input tcp dport 30000 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'TCP 30000 trusted' -Direction Inbound -Protocol TCP -LocalPort 30000 -RemoteAddress 203.0.113.10 -Action Allow