Port reference

3 min · 7 sections

What listens on each port, who opens it and which ones you may touch on the router and which you must not. This is the table you want in front of you when setting up the firewall, publishing something to the internet, or working out why a machine cannot reach the NAS.

Two things first:

The NAS firewall is managed by the panel. Each service opens its port when switched on and closes it when switched off; there is nothing to open by hand. Control Panel → Firewall shows what is open right now.
Opening a port on the ROUTER is a different thing, and most of this table is never opened. The right-hand column says so.

The panel

Port	What it is	To the router?
5001 /tcp	The panel, encrypted. The usual address	Only with a domain and a real certificate — see Access from the internet
5000 /tcp	Plain-HTTP redirect: it only sends you to 5001	No

Port	What it is	To the router?
445 /tcp	SMB — network folders for Windows and Mac	Never. It is the most attacked port on the internet
139 /tcp	NetBIOS, for older machines	Never
5353 /udp · 3702 /udp · 5357 /tcp	So the NAS appears by itself under "Network" (mDNS and WSD)	No. They only make sense inside the house
2049 /tcp · 111 /tcp · 20048 /tcp	NFS and its two helpers	Never
8081 /tcp	WebDAV (can be changed)	Only through the reverse proxy
873 /tcp	rsync server: where another NAS leaves its backups	Only towards that other NAS, and better over the VPN
22 /tcp	SSH and SFTP	Only if you know what you are doing; the VPN is better

Household services

Port	What it is	To the router?
51820 /udp	WireGuard VPN	Yes. It is the only one you need to open to get in from outside
53 /tcp+udp	The NAS's DNS server	Never. An open DNS is used to attack other people
67 /udp	DHCP server	Never. By design it does not leave the local network
631 /tcp	Network printer	No
161 /udp	SNMP, for monitoring it from another system	No
3260 /tcp	Network disks (iSCSI)	Never. It is a whole disk: use the VPN
9980 /tcp	The document editor, on the machine itself only	No
6881 /tcp+udp	Torrents: this is how other peers reach you	Yes, if you use torrents. Without it downloads are far slower

Cameras

Cameras do not listen on the NAS: the NAS calls them on its network. There is nothing to open, and above all do not open the camera's port on the router — it is the most common way to end up with your home camera listed in a camera search engine.

See Cameras.

How to check

From another machine on the network:

nc -vz 192.168.1.50 5001      # is the panel answering?

From the NAS itself, who holds each port:

sudo ss -tulpn | grep -E ':(445|5001|51820)\b'

And from the panel, Control Panel → Firewall shows the rules in place, and the Connectivity section has a port check without leaving the browser.

The short rule

If you are unsure about a port, do not open it on the router: set up the VPN and come in that way. It gives access to your whole home network, publishes nothing on the internet, and is a single UDP port. It is in Network services.