PORTNo auth by defaultTLS optionalIANA assigned
Port 6379Redis
Port 6379 is the default TCP port for Redis and compatible servers such as Valkey and KeyDB. Redis ships without a password and, in older versions, bound to all interfaces, which made exposed 6379 one of the most abused ports on the internet. Bind it to localhost or a private network and set requirepass or ACL users.
What port 6379 is used for
Redis is an in-memory data store used as a cache, session store, message broker and queue. Web applications, background workers and microservices connect to it on 6379 using the RESP protocol. Sentinel uses 26379; cluster bus traffic uses the data port plus 10000 (16379 by default).
Why exposed Redis is dangerous
Redis was designed for trusted networks. With no password, anyone who can reach 6379 can read and write every key, and Redis commands such as CONFIG SET dir and SAVE have been used to write files to the host, which historically led to remote code execution on servers that ran Redis as root. Automated scanners look for 6379 continuously.
Protections, in order:
- Bind to
127.0.0.1or a private interface (bindin redis.conf). - Set a strong password (
requirepass) or define ACL users with limited command sets (Redis 6+). - Rename or disable dangerous commands (
rename-command CONFIG "") on instances that do not need them. - Use TLS across shared networks.
- Firewall 6379 to application hosts.
How to check port 6379
Is something listening locally? On Windows, open Command Prompt and run:
netstat -ano | findstr :6379A line in the LISTENING state means a local program has bound port 6379; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :6379 or lsof -i :6379.
Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:
Test-NetConnection cache.internal.example -Port 6379TcpTestSucceeded : True means the remote system accepted a TCP connection on port 6379. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.
See the netstat and Test-NetConnection records for the full option sets.
Test with redis-cli if installed:
redis-cli -h cache.internal.example -p 6379 PINGA reply of PONG means the server answered; NOAUTH Authentication required means it is protected by a password, which is what you want.
Firewall considerations
Allow inbound 6379 only from application servers. Docker users: -p 6379:6379 publishes on all interfaces; use -p 127.0.0.1:6379:6379 for local development.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 6379 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
What is Redis protected mode?
A safety net introduced in Redis 3.2: if Redis is bound to all interfaces and no password is configured, it refuses connections from anything except loopback. Disabling it without setting a password re-creates the classic exposure.
Does Redis encrypt connections?
Redis 6 and later support TLS on a separate port (tls-port) when built with TLS support. Cloud-managed Redis usually offers TLS endpoints. Plain 6379 is unencrypted.