Port 4789 (VXLAN)

Virtual Extensible LAN overlay networks (Docker Swarm overlay, Calico, Cilium, NSX, EVPN fabrics).

Registered (user) port, 1024-49151 UDP Containers and Kubernetes Do not expose to the internet

Port 4789 is normally used over UDP; the checker tests TCP only, so a "filtered" result does not mean the UDP service is down.

What port 4789 is used for

Virtual Extensible LAN overlay networks (Docker Swarm overlay, Calico, Cilium, NSX, EVPN fabrics).

Security: should port 4789 be open?

Do not expose to the internet. VXLAN has no authentication; anyone who can send UDP 4789 to a host can inject packets into overlay networks. Never allow it from the internet.

IANA assignment

Service nameProtoDescriptionAssigneeReference

vxlan UDP Virtual eXtensible Local Area Network (VXLAN) IESG RFC-ietf-nvo3-rfc7348bis-12

Registry dates for this port: registered 2013-04-19, last modified 2026-11-05.

Check what is listening on port 4789

Linux: UDP 4789

sudo ss -ulnp 'sport = :4789'

Linux / macOS: which process owns the port

sudo lsof -nP -i :4789

Windows (Command Prompt)

netstat -ano | findstr :4789

Windows (PowerShell)

Get-NetUDPEndpoint -LocalPort 4789

Test it from outside

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 4789

Block port 4789 in the firewall

ufw

sudo ufw deny 4789/udp

iptables

sudo iptables -A INPUT -p udp --dport 4789 -j DROP

nftables

sudo nft add rule inet filter input udp dport 4789 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block UDP 4789' -Direction Inbound -Protocol UDP -LocalPort 4789 -Action Block

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.