Port 2189: Unassigned — Claimed by miniupnpd

Port 2189 sits in the registered port range (1024–49151), which means IANA theoretically manages it — but in this case, IANA left it blank. No protocol owns it officially. In practice, it belongs to UPnP.

What Actually Runs Here

The miniupnpd daemon — the UPnP implementation shipped inside pfSense, OPNsense, QNAP NAS devices, and dozens of other embedded networking platforms — uses port 2189 by default for its internal HTTP/SOAP control interface.¹²³

UPnP (Universal Plug and Play) lets devices on a local network negotiate port forwarding automatically. When your BitTorrent client or game console asks the router to open a port, it sends a SOAP request over HTTP to the UPnP daemon. Port 2189 is where miniupnpd listens for those requests.

This is strictly a local network port. It shouldn't be reachable from the Internet — and if it is, that's a misconfiguration worth fixing.

The Registered Port Range

The registered range (1024–49151) is where IANA accepts applications for port assignments. Get a service accepted, and your port number appears in the official registry. Leave the port unregistered, and software can still use it — it just isn't official.

Port 2189 is in this middle territory: registered range, unregistered port, one dominant unofficial use. That's more definition than most blank ports get.

What to Do If You See It

If port 2189 is open on your router or NAS:

• It's likely the UPnP daemon (miniupnpd) running normally
• Verify it's only accessible from your local network, not from the Internet
• If you don't need UPnP, disabling it closes the port entirely

To check what's listening on port 2189 on a Linux or macOS system:

# Show the process using port 2189
sudo ss -tlnp sport = :2189

# Or with lsof
sudo lsof -i :2189

# On Windows
netstat -ano | findstr :2189

Why Blank Ports Exist

IANA's registry has 49,151 registered slots and far fewer actual registrations. Most of the range is empty — not because nothing uses those ports, but because most software ships with a hardcoded default and never applies for official recognition. The port becomes "associated with" something through use, not through paperwork.

Port 2189 is an honest example of how ports actually work: a developer picked a number, shipped code with that number baked in, and now network admins worldwide are Googling "port 2189" when their UPnP daemon fails to bind.