Many excludedportranges how to delete - hyper-v is disabled

Question

Since the Windows update 2004 I am fighting with many programs and tools that can't bind to certain ports. A bit research I stumbled across: netsh interface ipv4 show excludedportrange protocol=tcp

In my case it yields (after disabling hyper-v, I switched to WSL2-based Docker):

Startport     Endport
----------    --------
  1131        1230
  1231        1330
  1331        1430
  1431        1530
  1735        1834
  1835        1934
  1943        2042
  2043        2142
  2143        2242
  2243        2342
  2343        2442
  2443        2542
  2543        2642
  2643        2742
  2743        2842
  2843        2942
  2943        3042
  3129        3228
  3229        3328
  3329        3428
  3429        3528
  3831        3930
  3931        4030
  4031        4130
  4131        4230
  4231        4330
  4531        4630
  4631        4730
  5241        5340
  5357        5357
  5458        5557
  5558        5657
  5658        5757
  6040        6139
  6140        6239
  6933        7032
  7033        7132
  7133        7232
  7233        7332
  7333        7432
  7633        7732
  7733        7832
  8001        8100
  8101        8200
  8201        8300
  8301        8400
  8401        8500
  8501        8600
 27972       28071
 28072       28171
 28172       28271
 28272       28371
 28572       28671
 28672       28771
 50000       50059     *

Currently the range 1431 through 1530 is preventing me from running my Oracle database. But the reserved ranges change after every reboot.

I tried to delete some ranges with netsh int ipv4 delete excludedportrange protocol=tcp startport=1431 numberofports=100 but it yields access denied (in admin cmd).

What is reserving these ranges and how to control them?

Answer 1

I found an answer at this GitHub comment: you might try

net stop winnat

to free the port. This worked for you in Windows 10 2004, and for me in Windows 10 20H2.

(In earlier version of Windows, I was successful with one of the following, compare How can I know what is preventing my socket to bind to localhost:50060-50959).

net stop LanmanWorkstation
net stop WlanSvc
net stop WwanSvc

While that may disconnect your network, don't despair. Because, if one of the above works for you, you may try the following once to fix this permanently:

netsh int ipv4 add excludedportrange protocol=tcp startport=50323 numberofports=1

(adapt the startport and the numberofports to your needs - also, consider ipv6 if needed).

This should survive a net start of the corresponding service as well as a reboot, as you can check using

netsh interface ipv4 show excludedportrange protocol=tcp

If this outputs

Protocol tcp Port Exclusion Ranges

Start Port    End Port
----------    --------
[...]
     50145       50244
     50323       50323     *
     50324       50423
[...]
* - Administered port exclusions.

you should be good for a while.

Answer 2

The answer by @yoshpe (relating to Hyper-V) is one potential cause of the issue.

However, the issue was different for me. In my case, it's because Windows started with its "dynamic ports" configured to start at port 1025 and end at port 5000. Because of this, when Docker Desktop started up, it would reserve its ports within the 1025-5000 port range, which was (sometimes!) conflicting with the ports that my own programs were configured to reserve/use. (for port-forwarding from my local Kubernetes cluster to localhost)

To see if your dynamic-ports is set incorrectly, you can run:

netsh int ipv4 show dynamicport tcp

If you see Start Port: 1025, then the dynamic-ports range is misconfigured. To fix it, you'll need to set it to a more sensible range -- avoiding the <10k ports. (which is typically where devs place their own apps)

To set it to the recommended range: (if your issue is with ipv6, then replace ipv4 with ipv6 iirc)

netsh int ipv4 set dynamic tcp start=49152 num=16384

For more info, see here: https://stackoverflow.com/a/62359555/2441655

Answer 3

It seems to be related to Hyper-V issues described here:

1. https://stackoverflow.com/a/63723105/3234715
2. https://github.com/docker/for-win/issues/3171
3. https://gist.github.com/strayge/481a77d31a94e133a76662877b1a90ca#another-workaround

I've added the registry key:

reg add HKLM\SYSTEM\CurrentControlSet\Services\hns\State /v EnableExcludedPortRange /d 0 /f

Which cleared most of the reserved ports (there are many reserved ranges such as 1612-2111, 2180-2779, etc..)