Which ports does RabbitMQ use, and which should stay private?

RabbitMQ clients use 5672 (or 5671 with TLS). The management UI uses 15672 or 15671 if enabled. Ports 4369 and 25672 are for node and CLI communication and should stay inside your cluster network unless you have a specific reason, such as federation, to expose them.

The port list

This table comes from the RabbitMQ networking documentation. Several ports exist only if a plugin is enabled.

Port 25672 is allocated from a dynamic range that defaults to a single port, computed as the AMQP port plus 20000.

What the documentation says to keep private

The same page says that unless external connections on the inter-node ports are really necessary, such as when the cluster uses federation or CLI tools run on machines outside the subnet, they should not be publicly exposed. That covers epmd and the distribution port. These ports carry the traffic that cluster nodes use to trust each other, which is why the Erlang cookie matters.

Steps to tighten

1. Run a port check from a host outside your trusted network against each broker host and write down every open port from the table.
2. Close anything that is not needed. If you do not use MQTT or STOMP, disable the plugin so the listener does not exist.
3. Separate audiences. Application subnets get the client ports. Operators get the management ports through a VPN or bastion. Cluster nodes get everything between themselves.
4. Move clients to TLS. RabbitMQ documents a configuration that disables the plain TCP listener and enables a TLS listener on 5671 with peer verification. Decide whether to require client certificates.
5. Check the management plugin. It is a web interface and an HTTP API, so treat it like any admin console, with named users and no public listener. See RabbitMQ guest user remote access and how to lock down.
6. Record the result so reviewers can see what the intended exposure is.

Plugins change the answer

A quick look at the default ports can mislead. Every enabled plugin adds a listener, and a broker that started life as plain AMQP may now accept MQTT, STOMP, WebSocket and metrics connections too. Review which plugins are enabled each time you review the ports, not only once during setup.

The Prometheus metrics port deserves a mention. Metrics are not secrets in the same sense as messages, but queue names and counts can reveal how your system works. Limit it to your monitoring network.

Try it yourself

Click through it at your own pace, or open it full screen. Watch how repeated checks surface change over time, and consider how a newly enabled plugin would show up in your own review.

Safeguard's asset discovery and policies can help you keep an inventory of infrastructure like brokers, and the free scan covers your code and dependencies.

Quick check

Sources

• RabbitMQ networking

Last reviewed: 19 October 2026.