Instructions on Network Port Opening¶

Quectel Pi development board only retains necessary network service listening in the default system environment to meet the requirements of device login, basic system services and local process communication. This document is intended to describe the default port opening status and external access boundaries of the device, and does not serve as a tutorial for developers on port troubleshooting or service configuration.

💡 The default externally accessible ports are primarily TCP 22 (SSH), which are used for remote login and maintenance of the development board. Other listening ports are bound to the local loopback address (127.0.0.1 or :: 1) by default, and are only available for local system components without being exposed to external networks.

Port Opening Principle¶

The default port policy of the development board follows the principle of minimum exposure: only services that need to be accessed by external hosts listen on the all-network address or network interface card address; services for internal system calls only listen on the loopback address. Ports on the loopback address can only be accessed by the development board itself, and the fact that a port is in a listening state does not mean that external hosts can access it.

After a device is connected to Ethernet, Wi-Fi or a cellular network, whether an external party can access a given service further depends on whether the service is listening on an externally reachable address, whether the network adapter has obtained a valid IP address, whether the network route is reachable, and whether there are upper-level firewalls, routers or operator restrictions in the on-site network.

Description of Default Port¶

Protocol/Port	Default listening range	Usage	Open Instructions
TCP 22	externally reachable address	SSH Remote Login	It is configured by default for remote login, debugging and maintenance of the development board. After the development board obtains a valid network IP, hosts within the same reachable network can access this port via SSH.
TCP 5037	`127.0.0.1`	ADB Local Service	This port is only bound to the local loopback address, which is used for communication between local ADB-related processes and is not open as an external network access port.
TCP 9083	`127.0.0.1`	local port bridge	This port is only for the internal services of the development board itself, and external hosts cannot access it via the network by default.
TCP/UDP 53	`127.0.0.53` / `127.0.0.54`	Local DNS Resolution	It is used by the local DNS stub resolver of the system, only for domain name resolution on the development board itself, and is not open as an external DNS service.
UDP 323	`127.0.0.1` / `::1`	Local Time Synchronization	Used by the local time synchronization service, and no time synchronization service is provided to the outside by default.

Common service ports that are not open by default¶

By default, the development board does not expose remote desktop, VNC or web service ports to external networks. For example, 3389 (RDP/xrdp), 5900 (VNC), 80 (HTTP) and 443 (HTTPS) — these ports will only have listening and external access capabilities after the user installs, enables and configures the corresponding services on their own.

port	Common Uses	Description of Default Status
TCP 3389	RDP / xrdp Remote Desktop	It is disabled by default; if you need to use the remote desktop, you need to install and enable the corresponding service by yourself.
TCP 5900	VNC Remote Desktop	Disabled by default; it can only listen after the VNC service is enabled.
TCP 80 / 443	HTTP/HTTPS Web Service	By default, it is not exposed externally as a Web Server; if the user deploys a Web application, the actual service configuration shall prevail.

Access Boundary Description¶

Open to public ports: refer to ports where the service listens on 0.0.0.0,[::] or the IP address of a specific network adapter, and the device is network-accessible. Such ports may be accessed by external hosts within the same network or a routable network.

Local loopback port: refers to the port on which the service listens at 127.0.0.1, 127.0.0.53, 127.0.0.54 or :: 1. Such ports are only accessible to processes on the development board itself and are not within the scope of exposure to external networks.

Network Reachability: Even if TCP port 22 is listening by default, an external host cannot establish a connection if the development board is not connected to a network, has not obtained an IP address, is not in a reachable network with the accessing host, or the upper-level network policy blocks SSH. This falls under network path conditions and does not change the device’s default port opening policy.

Safety Instructions¶

The SSH port is intended for development and maintenance scenarios. It is recommended to configure strong passwords, key-based login, account permissions, and network access control in accordance with the customer’s security requirements in mass production or delivery environments. If remote login capability is not required for the final product scenario, the SSH service may be disabled or the referrer may be restricted by the customer or project integrator in accordance with security policies.

It is not recommended to change the system ports that are bound to the loopback address by default to listen externally. Such ports usually serve internal system communications, and arbitrary exposure may introduce unnecessary security attack surfaces.