Skip to main content
protocols.pageprotocols.page
4222

Port 4222 – NATS

TCP

Port 4222 is the default NATS server client connection port. NATS is a lightweight, high-performance publish-subscribe messaging system. The NATS monitoring HTTP endpoint runs on port 8222. NATS Cluster routing uses port 6222. NATS is used in Kubernetes and microservice architectures as an alternative to Kafka and RabbitMQ for low-latency messaging.

Port Number

4222

Protocol

TCP

Service

NATS Messaging System

Range

IANA Registered (1024–49151)

Description

NATS on port 4222 uses a simple text-based protocol. Clients connect and authenticate (if auth is configured), then publish to subjects and subscribe to patterns. NATS JetStream (persistent messaging) also uses port 4222. NATS has no built-in authentication by default – production deployments must configure TLS and credentials. Monitoring via HTTP on port 8222.

Security risks

  • 1No-auth default: NATS ships without authentication. Any client reaching port 4222 can publish to any subject and subscribe to all messages. Enable at minimum token auth (authorization { token: 'secret' }) or NKey-based authentication for production.
  • 2Message interception: without TLS on port 4222, all messages travel in cleartext. In a shared network, any observer reads all pub-sub traffic. Enable TLS: tls { cert_file: ... key_file: ... }.
  • 3JetStream data exposure: NATS JetStream stores persistent messages. Unauthenticated access means reading all stored streams and consumers – potentially containing business-critical events.

Firewall guidance

Restrict port 4222 to application servers that publish/subscribe. The monitoring port (8222) should be on a management network only. NATS cluster routing (6222) should be restricted to other NATS server IPs. In Kubernetes, use a ClusterIP Service – never LoadBalancer for NATS.

Diagnosis commands

Test NATS connectivity and server health

shell
nats server check connection -s nats://host:4222

NATS server stats – connections, messages in/out, bytes

shell
curl http://host:8222/varz

Subscribe to all subjects and print 5 messages (debugging)

shell
nats sub -s nats://host:4222 '>' --count 5

Usage examples

Port 4222 – NATS
shell
nats-sub -s nats://localhost:4222 '>'
nats pub -s nats://localhost:4222 greet 'hello'
curl http://localhost:8222/varz

Common services on this port

NATS ServerNATS JetStreamSynadia Cloudnats-streaming-server (deprecated)

Related ports

6222

NATS cluster routing

8222

NATS monitoring HTTP

9092

Kafka (alternative)

5672

RabbitMQ AMQP (alternative)

History

NATS was created by Derek Collison (founder of Synadia, previously TIBCO architect) in 2010. Originally written in Ruby, rewritten in Go for performance. NATS JetStream (persistent messaging) was added in 2021 as the built-in replacement for the deprecated NATS Streaming (stan).

FAQ

NATS vs Kafka vs RabbitMQ?

NATS: lowest latency (~100us), simplest operations, ephemeral by default (JetStream for persistence). Kafka: highest throughput, durable by default, best for event sourcing/replay. RabbitMQ: richest routing (exchanges/bindings), best for complex message patterns and task queues. Choose by primary requirement: speed (NATS), durability (Kafka), routing (RabbitMQ).