Network ports · 5432
5432 — PostgreSQL
Port 5432 is the default PostgreSQL listener.
Key facts
| Port | 5432 |
|---|---|
| Transport | TCP |
| Service | PostgreSQL |
| Access control | <code>pg_hba.conf</code> |
| Encryption | TLS supported |
| Exposure | Keep private |
Two gates: listen and authenticate
PostgreSQL needs two things to accept a remote connection: the server must listen on an address that reaches the client, and pg_hba.conf must allow the host, user and database combination. Both default to restrictive values, which is why a fresh install is not reachable from another machine.
Keep it that way unless there is a specific need. Application servers on the same private network can be allowed by CIDR; the public internet should not appear in the file.
TLS and credentials
Require TLS for non-local connections and use scram-sha-256 password authentication or certificate authentication. A password sent without TLS is exposed to anyone on the path.
Create one role per application with only the privileges it needs. Superuser access belongs to administration, not to the web process.
Frequently asked questions
Why can I not connect to PostgreSQL remotely?
Either listen_addresses does not include the interface or pg_hba.conf has no matching rule. Both must allow the connection.
Does PostgreSQL encrypt connections by default?
No. TLS must be configured and required in pg_hba.conf for the relevant host entries.