Port 636: LDAPS

What is port 636 used for?

LDAP over TLS.

Should port 636 be open?

Don’t expose to the internet. Keep this port on private networks and reach it through a VPN or SSH tunnel. Encrypted, but a directory service still shouldn’t face the internet. Restrict it to internal networks or a VPN.

See what is listening on port 636

# Linux
sudo ss -tlnp | grep ':636 '

# macOS
sudo lsof -nP -i TCP:636 -sTCP:LISTEN

# Windows (PowerShell)
Get-NetTCPConnection -LocalPort 636 -State Listen

Open or block port 636 in a firewall

# Ubuntu / Debian (ufw)
sudo ufw allow 636/tcp
sudo ufw deny 636/tcp

# Windows (PowerShell, as administrator)
New-NetFirewallRule -DisplayName "Port 636" -Direction Inbound -Protocol TCP -LocalPort 636 -Action Allow

On cloud servers, also open the port in the provider’s security group or network firewall. At home, a service behind a router needs a port-forwarding rule to the device’s local IP.

Test it from outside

A port can be open on the server but blocked upstream. The Port Checker connects from the internet, so it shows what the world sees. From your own machine, use nc -vz example.com 636 (macOS/Linux) or Test-NetConnection example.com -Port 636 (Windows).