Port 5432PostgreSQL

What port 5432 is used for

PostgreSQL clients (psql, application drivers, pgAdmin, ORMs) speak the PostgreSQL frontend/backend protocol on port 5432. Replication between a primary and its standbys uses the same port. Connection poolers such as PgBouncer often sit in front of it, sometimes on 6432.

Two layers of access control

1. listen_addresses in postgresql.conf decides which network interfaces the server binds. The default localhost means port 5432 is not reachable from other machines at all.
2. pg_hba.conf decides which clients may authenticate once they connect. A typical line for an application subnet:

hostssl  appdb  appuser  10.20.30.0/24  scram-sha-256

hostssl requires TLS; host allows either. Use the Subnet Calculator to express the client range in CIDR.

Security considerations

• Use scram-sha-256, not md5 or password, for password authentication.
• Never use trust for non-local connections.
• Require TLS across any shared network with hostssl rules and ssl = on.
• Keep 5432 off the internet. Exposed PostgreSQL instances with weak passwords are routinely turned into cryptominers.

How to check port 5432

Is something listening locally? On Windows, open Command Prompt and run:

netstat -ano | findstr :5432

A line in the LISTENING state means a local program has bound port 5432; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :5432 or lsof -i :5432.

Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:

Test-NetConnection db.internal.example -Port 5432

TcpTestSucceeded : True means the remote system accepted a TCP connection on port 5432. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.

See the netstat and Test-NetConnection records for the full option sets.

From inside psql, confirm the listening configuration:

SHOW listen_addresses;
SHOW port;
SHOW ssl;

Firewall considerations

Allow inbound 5432 only from application servers and administrative hosts. Cloud security groups should reference the application security group, not an address range, where the platform supports it.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 5432 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.