How do I get the kestrel web server to listen to non-localhost requests?

For AspNetCore 3.1+ just add the following line in the file appsettings.json:

"Urls": "http://*:80"

If you use asp.net core 2.1+,modify config section in appsettings.json.

"Kestrel": {
  "EndPoints": {
    "Http": {
      "Url": "http://0.0.0.0:5002"
    }
  }
},

In RC2 the commands section of project.json is no longer used. I haven't gotten Kestrel to pick up the hosting.json yet, but you can programatically set the port in the Main of the application where the new WebHostBuilder is created and configured. Just add .UseUrls() method like in the sample below

    public static void Main(string[] args)
    {
        var host = new WebHostBuilder()
            .UseUrls("http://0.0.0.0:5000/")
            .UseKestrel()
            .UseContentRoot(Directory.GetCurrentDirectory())
            .UseIISIntegration()
            .UseStartup<Startup>()
            .Build();

        host.Run();
    }

The default configuration file used by Kestrel server is hosting.json. The name was changed multiple times in different beta versions. If you use now project.json with the following "command" section

"commands": {
    "web": "Microsoft.AspNet.Server.Kestrel"
}

then during starting the server from the command line by

dnx web

the file hosting.json will be read. The file

{
    "server.urls": "http://0.0.0.0:5000"
}

will configure the server to listen 5000 on every IP4 address. The configuration

{
    "server.urls": "http://::5000;http://0.0.0.0:5000"
}

will inform to listen 5000 on both IP4 and IP6 address.

One can specify alternative configuration files by usage ASPNET_ENV environment variable or by the usage of --config myconfig1.json (or config=myconfig1.json). For example you can use

SET ASPNET_ENV=Development

and to create hosting.Development.json file with specific configuration. Alternatively you can use project.json with

"commands": {
    "web": "Microsoft.AspNet.Server.Kestrel"
    "webProd": "Microsoft.AspNet.Server.Kestrel --config prod.json"
}

and start the server by usage

dnx webProd

I have to remind additionally that it could be required that you allow to additionally listen and to register (to start dnx web). It's required because of the firewall and the local security of listening new TCP/HTTP ports. Something like below should make local registering and listening of 5000 port for everybody (IPv4 and IPv6):

netsh http add iplisten ipaddress=0.0.0.0:5000
netsh http add iplisten ipaddress=::5000
netsh http add urlacl url=http://+:5000/ user=\Everyone

To be more secure you can adjust the above configuration to grant minimal rights.

UPDATED: Thanks @BlaneBunderson. One can use * instead of IP address (like http://*:5000) to listen on any IP4 and IP6 addresses from any interface. One should be carefully and not use these

• http://*:5000;http://::5000
• http://::5000;http://*:5000
• http://*:5000;http://0.0.0.0:5000
• http://*:5000;http://0.0.0.0:5000

because it will require to register IP6 address :: or IP4 address 0.0.0.0 twice.

Corresponds to the announcement

Technically, any hostname that isn't "localhost" or a valid IPv4 or IPv6 address will cause Kestrel to bind to all network interfaces.

I think that the behavior could be changed in the future. Thus I would recommend to use only *:5000, 0.0.0.0:5000 and ::5000 form for registering of any IT address.

UPDATED 2: ASP.NET Core RC2 changes (see the announcement) the behavior of loading the defaults. One have to make changes in the Main to load the settings from hosting.json and the command line parameters. Below is an example of the usage

public static void Main(string[] args)
{
    var config = new ConfigurationBuilder()
        .SetBasePath(Directory.GetCurrentDirectory())
        .AddJsonFile("hosting.json", optional: true)
        .AddEnvironmentVariables(prefix: "ASPNETCORE_")
        .AddCommandLine(args)
        .Build();

    var host = new WebHostBuilder()
        .UseUrls("http://*:1000", "https://*:1234", "http://0.0.0.0:5000")
        .UseEnvironment("Development")
        .UseConfiguration(config)
        .UseKestrel()
        .UseContentRoot(Directory.GetCurrentDirectory())
        .UseIISIntegration()
        .UseStartup<Startup>()
        .Build();

    host.Run();
}

The above code use three bindings: "http://*:1000", "https://*:1234", "http://0.0.0.0:5000" by default instead of usage the default port 5000 by default (to be exact the usage of http://localhost:5000). The call of .UseConfiguration(config) are made after .UseUrls. Thus the configuration loaded from hosting.json or the command line overwrite the default options. If one remove .SetBasePath(Directory.GetCurrentDirectory()) line then the hosting.json will be loaded from the same directory where the application dll will be compiled (for example bin\Debug\netcoreapp1.0).

One can use execution like

dotnet.exe run --server.urls=http://0.0.0.0:5000

to overwrite the default settings (from UseUrls) and the settings from "server.urls" property of hosting.json if it's exist.

In the same way one could overwrite the ULR settings by setting the environment variable

set ASPNETCORE_SERVER.URLS=http://localhost:12541/

then the default start of the application using dotnet.exe run will use http://localhost:12541/ for binding.

You can find here an example of the usage of HTTPS binding.

REMARK: The name of environment variable is changed from ASPNETCORE_SERVER.URLS to ASPNETCORE_URLS in later versions of ASP.NET(see here the documentation of ASP.NET Core 3.1).