Rabbitmq-server: Unable to stop RabbitMQ from listening on port 25672 on all interfaces

[Paradoxis]

I'm currently working on an application using celery in combination with rabbitmq, due to security concerns no services that don't require any connection with the internet should only listen on localhost.

After looking around I found this question which shows how I can make _most_ ports listen only on localhost, however for some reason port 25672 remains open, which I determined to be part of rabbitmq:

$ nmap -sV -p25672 -T5 <my server>

Starting Nmap 7.50 ( https://nmap.org ) at 2018-08-04 23:54 CEST
Nmap scan report for <my server> (<my server>)
Host is up (0.011s latency).

PORT      STATE  SERVICE VERSION
25672/tcp open   unknown

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 124.87 seconds

On the server:

$ lsof -i :25672
COMMAND   PID     USER   FD   TYPE    DEVICE SIZE/OFF NODE NAME
beam.smp 4513 rabbitmq   12u  IPv4 473675236      0t0  TCP *:25672 (LISTEN)

The man entry for rabbitmq does not state how to change this, nor can I find out how to do so online. Could anyone point me in the right direction on how to make it listen on 127.0.0.1 rather than 0.0.0.0?

• RabbitMQ version: 3.5.7
• Erlang version: 18.3

[michaelklishin]

Thank you for your time.

Team RabbitMQ uses GitHub issues for specific actionable items engineers can work on. GitHub issues are not used for questions, investigations, root cause analysis, discussions of potential issues, etc (as defined by this team).

We get at least a dozen of questions through various venues every single day, often light on details.
At that rate GitHub issues can very quickly turn into a something impossible to navigate and make sense of even for our team. Because GitHub is a tool our team uses heavily nearly every day, the signal/noise ratio of issues is something we care about a lot.

Please post this to rabbitmq-users.

Thank you.

[michaelklishin]

RabbitMQ documentation is fairly extensive and cannot be put into a single man page. There's a dedicated Networking guide.

Port 25672 is used specifically for inter-node and CLI tool communication and it makes no sense to limit it to localhost (same goes for the epmd port). If you do, you will be able to connect and use CLI tools against that node only from localhost which is not what RabbitMQ was designed for.

On an unrelated note, RabbitMQ 3.5.x has been out of any kind of support for a while now. Consider upgrading since you are tens of release behind.

[michaelklishin]

Binding epmd to localhost is possible (it makes about as much sense as limiting a DNS server to localhost, however) but our docs do not really cover it since it's a part of the runtime.

There are pretty decent summaries available and epmd has doc guide of its own which has an access restriction section at the bottom.

Please direct all further questions to rabbitmq-users and erlang-questions.