kube-apiserver, the control-plane endpoint kubectl and every node talk to. k3s and kubeadm clusters use 6443; managed clusters often expose it on 443.
kube-apiserver, the control-plane endpoint kubectl and every node talk to. k3s and kubeadm clusters use 6443; managed clusters often expose it on 443.
Expose only to trusted sources. Prefer a private endpoint or an IP allowlist. Make sure anonymous auth cannot reach anything useful and RBAC is tight; leaked kubeconfigs and over-privileged service accounts are the usual way in.
Registry dates for this port: registered 2006-03.
sudo ss -tlnp 'sport = :6443'sudo lsof -nP -i :6443sudo netstat -tlnp | grep ':6443 'netstat -ano | findstr :6443Get-NetTCPConnection -LocalPort 6443 -State Listen | Select LocalAddress,OwningProcessnc -vz -w 5 HOST 6443Test-NetConnection HOST -Port 6443Replace 203.0.113.10 with the address or network you trust. With ufw, make sure the default incoming policy is deny.
sudo ufw allow from 203.0.113.10 to any port 6443 proto tcpsudo iptables -A INPUT -p tcp --dport 6443 -s 203.0.113.10 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 6443 -j DROPsudo nft add rule inet filter input ip saddr 203.0.113.10 tcp dport 6443 accept
sudo nft add rule inet filter input tcp dport 6443 dropNew-NetFirewallRule -DisplayName 'TCP 6443 trusted' -Direction Inbound -Protocol TCP -LocalPort 6443 -RemoteAddress 203.0.113.10 -Action AllowAll port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.