When trying to start docker container, the following errors is shown:

Cannot start service <service>: Ports are not available: listen tcp bind: An attempt was made to access a socket in a way forbidden by its access permissions.

netstat -aon shows that port is not in used.

Running netsh int ipv4 show excludedportrange protocol=tcp shows:

Start Port    End Port
----------    --------
      1037        1136
      1137        1236
      1641        1740
      1741        1840
      2869        2869
      5357        5357
      5433        5532
      5533        5632
     10243       10243
     34036       34135
     34136       34235
     48369       48468
     48469       48568
     48569       48668
     48669       48768
     50000       50059     *

So it seems that port range 5533-5632 is excluded.

How can I find the culprit that added this exclusion range, and why?

  • What happens if you run the following in a PowerShell prompt: ([System.Net.Sockets.TcpListener]5601).Start()? What account does the service run as? Local System? Also, what OS is it? Nov 22, 2020 at 21:37
  • What's the OS version of your client? Is Hyper-v feature enabled on it?
    – Sunny
    Nov 23, 2020 at 8:33
  • 3
    I've already solved my issue thanks to github comunity by changing the dynamic port range start, that was too low, possibly due to windows update. Isn't there a method to find who excluded ports? Or you have to guess?
    – cdalxndr
    Nov 24, 2020 at 1:03

1 Answer 1


It's probably because of Windows NAT. Restarting WinNAT might be enough to remove all excluded port ranges except the administrated one.

In your case, you might want to stop WinNAT:

net stop winnat

Then, start your docker container before starting WinNAT:

net start winnat

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .