mellonbotOpen ports
A port is like a door into your server for a specific service. Your website needs a couple of doors open, but databases, admin panels and test tools often end up reachable from the whole internet by accident.
- At a glance
- Group
- Security
- Mellonbot
- Explains, you decide
- What it does
- Lists them in plain English, with how to close them.
- Approval
- You make the change
What you’ll notice
- A database or admin tool can be reached from outside
- Security scanners report open ports you don’t recognise
- Unexpected connections in your logs
- Services left over from testing are still listening
Why it usually happens
- A service listens on every network address by default
- No firewall is set up, or it allows everything
- A test or development tool was never switched off
- Docker publishes a container’s port to the internet
Fix it yourself
How to fix it by hand
Comfortable with a terminal? Here’s what an experienced admin would do. Start with the read-only commands.
- 01
List everything that’s listening
Addresses like 0.0.0.0 or * mean “reachable from anywhere”.
sudo ss -tlnp - 02
Check the firewall
Shows which ports your firewall allows, if it’s on.
sudo ufw status verbose - 03
Check Docker’s published ports
Ports shown as 0.0.0.0:… are open to the internet.
docker ps --format "{{.Names}} {{.Ports}}" - 04
Close what shouldn’t be open
Make the service listen only on 127.0.0.1, or block the port in your firewall — for example, deny a public database port.
sudo ufw deny 3306/tcp
With Mellonbot
How Mellonbot helps
- Checks which services are reachable from the internet.
- Lists them in plain English, flagging the ones that shouldn’t be public.
- Shows you exactly how to close each one — firewall changes are yours to make.
- Scheduled checks tell you if a new port opens unexpectedly.
FAQ
Open ports: common questions
Which ports should be open on a web server?
Usually just 80 and 443 for the website, and SSH for you to log in. Databases and admin tools should normally only be reachable from the server itself.
Is it dangerous to have my database port open?
Yes. Anyone can try to log in to it, and databases are a favourite target. Keep it private unless you really need outside access.
Private alpha · invites in small waves
Let Mellonbot look after your server
Join the alpha with one email address. Early testers help shape Mellonbot and keep the founding-member perks after launch.
- No card needed
- Leave any time