Skip to main content
protocols.pageprotocols.page
8500

Port 8500 – HashiCorp Consul

TCP

Port 8500 is the HashiCorp Consul HTTP API and web UI port. Consul provides service discovery, health checking, key-value storage, and service mesh. Port 8500 is unauthenticated by default – exposing it publicly allows anyone to read service registrations, KV data, and health check results. Consul also uses ports 8300 (RPC), 8301/8302 (Serf LAN/WAN), and 8600 (DNS).

Port Number

8500

Protocol

TCP

Service

Consul HTTP API

Range

IANA Registered (1024–49151)

Description

Consul's HTTP API on port 8500 covers service registration, health queries, KV operations, and leader election status. The web UI is served on the same port. Default Consul has no ACLs enabled – all operations are unauthenticated. Production deployments must enable ACL system with tokens and restrict port 8500 access to internal networks. Consul Connect (service mesh) adds TLS and mTLS between services.

Security risks

  • 1No ACLs by default: Consul ships with ACLs disabled. Any client reaching port 8500 can register/deregister services (enabling traffic hijacking), read/write KV store data (credentials, configs), and query cluster topology. Enable ACLs: consul acl bootstrap to create the initial management token.
  • 2KV store credential leakage: applications commonly store database URLs, API keys, and TLS certificates in Consul KV. Unauthenticated access to GET /v1/kv/?recurse dumps all stored secrets. Even with ACLs, KV values are not encrypted at rest without Vault integration.
  • 3Service registration hijacking: without ACLs, an attacker registers a malicious service with the same name as a legitimate one. DNS queries and Connect proxies route traffic to the attacker's endpoint (service impersonation).
  • 4Exec command (deprecated but dangerous): consul exec ran commands on all agents. While deprecated, older Consul versions may still have it enabled. Verify with: consul info | grep exec.

Firewall guidance

Restrict port 8500 to application servers and admin workstations on trusted networks. The Consul web UI (same port) should be behind an authenticating reverse proxy or restricted by IP. Consul gossip ports (8301/8302) need to be open between all Consul agents. RPC port (8300) only between servers. DNS (8600) only from clients querying service discovery.

Diagnosis commands

Check Consul cluster leader (returns IP:port of leader)

shell
curl -s http://localhost:8500/v1/status/leader

List all Consul cluster members and their status

shell
consul members -http-addr=http://host:8500

Find failing health checks

shell
curl -s http://localhost:8500/v1/agent/checks | jq 'to_entries[] | select(.value.Status != "passing")'

Usage examples

Port 8500 – HashiCorp Consul
shell
curl http://localhost:8500/v1/health/service/web
curl http://localhost:8500/v1/kv/config/db-url
consul members -http-addr=http://localhost:8500

Common services on this port

HashiCorp ConsulConsul EnterpriseConsul Connect (service mesh)HashiCorp Nomad (uses Consul)

Related ports

8300

Consul RPC (server-to-server)

8301

Consul Serf LAN (gossip)

8600

Consul DNS interface

History

Consul was released by HashiCorp in 2014. It combines service discovery (DNS + HTTP), health checking, KV store, and (since 1.2, 2018) a service mesh (Connect). Port 8500 was chosen for the HTTP API. Consul competes with etcd (pure KV), ZooKeeper (coordination), and Eureka (service discovery).

FAQ

Consul vs etcd vs ZooKeeper?

Consul: service discovery + health checks + KV + service mesh in one tool. etcd: pure distributed KV (Kubernetes backing store). ZooKeeper: coordination primitives (leader election, distributed locks). Consul is the most feature-complete for microservice architectures; etcd is the Kubernetes standard; ZooKeeper is legacy (being replaced by KRaft in Kafka).

How do I enable Consul ACLs?

In consul server config: acl { enabled = true, default_policy = 'deny' }. Restart servers. Run: consul acl bootstrap (saves the initial management token). Then create per-service tokens with minimal permissions. All API calls must include X-Consul-Token header or -token flag.