Port 9200: Elasticsearch

What is port 9200 used for?

The Elasticsearch REST API.

Should port 9200 be open?

Don’t expose to the internet. Keep this port on private networks and reach it through a VPN or SSH tunnel. Unsecured Elasticsearch clusters have caused many large data leaks. Enable security and keep the cluster private.

See what is listening on port 9200

# Linux
sudo ss -tlnp | grep ':9200 '

# macOS
sudo lsof -nP -i TCP:9200 -sTCP:LISTEN

# Windows (PowerShell)
Get-NetTCPConnection -LocalPort 9200 -State Listen

Open or block port 9200 in a firewall

# Ubuntu / Debian (ufw)
sudo ufw allow 9200/tcp
sudo ufw deny 9200/tcp

# Windows (PowerShell, as administrator)
New-NetFirewallRule -DisplayName "Port 9200" -Direction Inbound -Protocol TCP -LocalPort 9200 -Action Allow

On cloud servers, also open the port in the provider’s security group or network firewall. At home, a service behind a router needs a port-forwarding rule to the device’s local IP.

Test it from outside

A port can be open on the server but blocked upstream. The Port Checker connects from the internet, so it shows what the world sees. From your own machine, use nc -vz example.com 9200 (macOS/Linux) or Test-NetConnection example.com -Port 9200 (Windows).