Port 5000: Synology DSM / UPnP / dev
Port 5000 has several common uses: the Synology NAS admin page, Mac AirPlay Receiver, UPnP on some routers, and developer web servers.
What runs on port 5000
Synology's DiskStation Manager serves its web interface on TCP 5000 over HTTP, and 5001 over HTTPS. Flask and other development servers default to 5000. On macOS Monterey and later, the AirPlay Receiver feature listens on 5000 and 7000, which surprised many developers whose own apps could no longer use the port.
On a home network
Synology NAS boxes, Macs with AirPlay Receiver enabled, and some routers that serve UPnP control on 5000. Developers' laptops running test servers as well.
If port 5000 is reachable from the internet
A Synology DSM login page reachable from the internet is a common target: Synology warned in 2021 of a botnet brute forcing exposed DSM logins, and ransomware groups have targeted exposed NAS boxes. A router exposing UPnP control on its WAN side lets outsiders open ports on it. Use Synology's QuickConnect or a VPN rather than forwarding 5000.
How to check whether it is open on your network
In Synology DSM, check External Access and your router's UPnP table for mappings to 5000 and 5001. RECON's Exposure Check shows whether 5000 answers on your public address.
To find out whether port 5000 is open on something in your home, and whether the internet can reach it, the app scans your Wi-Fi from your phone and checks your public address from the outside. It says what it checked and what it could not. Get RECON for iPhone — one-time purchase, no account, nothing leaves the device.