Applications' ports
Before installation, in the config.yml file, specify ports for required application components.
The following table lists the default ports for each application component.
Access types:
- external – for end users
- internal – for internal application communication
We highly recommend restricting the internal ports using the IPtables or FirewallD Linux firewall or Windows Firewall to protect data according to the company's standard security policy, so that outside of WorkFusion application should not access internal API thought ports. Applying this change will restrict the malicious user to get into the application to perform any activity.
| Destination Server Name | Destination Port | Source Server Name | Service name | Access Type |
|---|---|---|---|---|
| APP (WF Control Tower) | 80, 443/tcp | all | nginx (proxy for Control Tower, WorkSpace, bot-manager, AutoQC, Nexus, Minio, Tinymce, Kibana) | external |
| 7083/tcp | BEP Agents, RPA | nginx (mTLS proxy for Control Tower) | internal | |
| 22/tcp | INT | ssh | internal | |
| Integration Server | 80, 443/tcp | BEP Master, APP, OCR | nginx (proxy for Nexus, Minio) | internal |
| 8200/tcp | APP, BEP Master, BEP Agents, OCR, OCRWIN, RPA | Vault (secure store) | internal | |
| 45672/tcp | Integration server (TDS) | nginx (proxy for rabbitmq api) | internal | |
| 5672/tcp | APP, BEP Master, BEP Agents, OCR, RPA | rabbitmq queue | internal | |
| 2181/tcp | APP, BEP Master, BEP Agents | zookeeper | internal | |
| 4567-4571/tcp, 15072/udp | APP, BEP Master, BEP Agents, OCR, OCRWIN, RPA, OCR | logstash | internal | |
| 9200/tcp | APP, INT | ElasticSearch | internal | |
| 9092/tcp | BEP Master | nginx (mTLS proxy for TDS) | internal | |
| OCR | 80, 443/tcp | BEP agent, APP | nginx (proxy for OCR rest API) | internal |
| 22/tcp | INT | ssh | internal | |
| OCRWIN | 80, 443/tcp | BEP agent, APP | nginx (proxy for OCR rest API) | internal |
| 5986/tcp | INT | WinRM | internal | |
| BEP Master | 80, 443/tcp | APP | nginx (proxy for AutoML services APIs) | internal |
| 8480/tcp | BEP Agent | nginx (proxy for marathon) | internal | |
| 5050/tcp | BEP Agent | mesos-master | internal | |
| 9000-61000/tcp+udp | BEP Agent, INT | mesos-master, filebeat, heartbeat, metricbeat | internal | |
| 111/tcp+udp | BEP Agent | NFS | internal | |
| 1039/tcp+udp | BEP Agent | NFS | internal | |
| 1047/tcp+udp | BEP Agent | NFS | internal | |
| 1048/tcp+udp | BEP Agent | NFS | internal | |
| 2049/tcp+udp | BEP Agent | NFS | internal | |
| 20048/tcp+udp | BEP Agent | NFS | internal | |
| 22/tcp | INT | ssh | internal | |
| 9093/tcp | APP | nginx (mTLS proxy for worker management service ) | internal | |
| 9073/tcp | APP, RPA, BEP Agent | nginx (mTLS for AutoML gateway-service) | internal | |
| BEP Agent(s) | 5051/tcp | BEP Master | mesos-slave | internal |
| 9000-61000/tcp+udp | BEP Master, INT | mesos-slave, filebeat, heartbeat, metricbeat | internal | |
| 22/tcp | INT | ssh | internal | |
| RPA | 80, 443/tcp | APP | nginx (proxy for RPA hub) | internal |
| 5986/tcp | INT | WinRM | internal | |
| 3389/tcp | APP | RDP | internal | |
| BI | 80, 443/tcp | all | apache (proxy for Tableau Web Interface) | external |
| 5986/tcp | INT | WinRM | internal | |
| MSSQL | 1433 | INT, APP, OCR, OCRWIN, BEP Agent(s), BI | MS SQL | internal |
Additional ports for external NFS server
If you plan to use an external NFS server, open the following ports besides the ones earlier:
| Source server | Destination server | Destination port | Service name | Access type |
|---|---|---|---|---|
| All servers | NFS | 111/tcp+udp | NFS | internal |
| All servers | NFS | 2049/tcp+udp | NFS | internal |
In case you have STATD_PORT, LOCKD_TCPPORT, and LOCKD_UDPPORT statically defined on your NFS server, make sure that traffic is allowed from all IA Cloud servers towards these ports on the NFS server. Otherwise, make sure that traffic is allowed from all IAC servers towards port range 1024 - 65535 on the NFS server.
WorkFusion URLs
|
Server |
URLS |
Description |
|
APP (WorkFusion Control Tower) |
https://app_hostname/workfusion |
Control Tower (external) |
|
https://app_hostname/workfusion-resources |
CT static resources (external) |
|
|
https://app_hostname/workfusion/public/HTMLRenderer |
CT HTML renderer (external) |
|
|
https://app_hostname/workspace |
WorkSpace (external) |
|
|
https://app_hostname/nexus |
Nexus (external) |
|
|
https://app_hostname/sqc-rest |
AutoQC (external) |
|
|
https://app_hostname/tinymce |
Tinymce (external) |
|
|
https://app_hostname/kibana |
Kibana (external) |
|
|
https://s3_hostname/minio |
Minio (S3 emulator) (external) |
|
|
Integration server |
https://int_hostname:45672/ |
RabbitMQ API |
|
https://int_hostname/minio |
Minio |
|
|
https://int_hostname/nexus |
Nexus |
|
|
https://int_hostname:9200/ |
Elasticsearch |
|
|
BEP Master |
https://bep_master_hostname/automl-model-service |
AutoML Model Service |
|
https://bep_master_hostname:8480/ |
Marathon |
|
|
https://bep_master_hostname:5050/ |
Mesos |
|
|
OCR Server |
https://ocr_hostname/ |
OCR Rest API |
|
BI Server |
https://bi_hostname/ |
Tableau web interface (external) |