Ports
Before installation, in the config.yml file, specify ports for required application components.
The following table lists the default ports for each application component.
Access types:
- external – for end users
- internal – for internal application communication
We highly recommend restricting the internal ports using the IPtables or FirewallD Linux firewall or Windows Firewall to protect data according to the company's standard security policy, so that outside of WorkFusion application won't access internal API thought ports. Applying this change will restrict the malicious user to get into the application to perform any activity.
Common application ports
Destination Server: APP (Control Tower)
| Destination port | Source server name | Service name | Access type |
|---|---|---|---|
| 80, 443/tcp | all | HAProxy (proxy for Control Tower, WorkSpace, bot-manager, AutoQC, Nexus, Minio, Kibana) | external |
| 8080, 8443/tcp | APP, INT | nginx (proxy for Control Tower, WorkSpace, bot-manager, AutoQC, Nexus, Minio, Kibana) | internal |
| 8200/tcp | all | HAProxy(proxy for Vault) | internal |
| 9200/tcp | INT, APP, BEP Master, BEP Agents, MSSQL | HAProxy (proxy for ElasticSearch) | internal |
| 9073/tcp | APP, RPA, BEP Master, BEP Agents | HAProxy (proxy for AutoML gateway-service) | internal |
| 5553/tcp | RPA | HAProxy (proxy for bot-manager service) | internal |
| 5554/tcp | APP | nginx (mTLC proxy for bot-manager service) | internal |
| 9075/tcp | BEP Master | HAProxy (proxy for AutoML model-service) | internal |
| 9076/tcp | BEP Master | HAProxy (proxy for AutoML model-management-service) | internal |
| 9092/tcp | BEP Master, INT | HAProxy (proxy for task dispatcher service) | internal |
| 9093/tcp | APP, BEP Master | HAProxy (proxy for worker management service) | internal |
| 4083/tcp | APP | HAProxy (proxy for SQC) | internal |
| 4084/tcp | APP | nginx (mTLS proxy for SQC) | internal |
| 7083/tcp | BEP Agents, RPA, APP | HAProxy (proxy for Control Tower) | internal |
| 7084/tcp | APP | nginx (mTLS proxy for Control Tower) | internal |
| 22/tcp | INT | SSH | internal |
Destination Server: INT
| Destination port | Source server name | Service name | Access type |
|---|---|---|---|
| 8080, 8443/tcp | APP | nginx (proxy for Nexus, Minio and RabbitMQ api) | internal |
| 8200/tcp | APP | Vault (secure store) | internal |
| 45672/tcp | APP | nginx (proxy for RabbitMQ api) | internal |
| 5672/tcp | APP, BEP Master, BEP Agents, OCR, RPA | RabbitMQ queue | internal |
| 2181/tcp | APP, BEP Master, BEP Agents, OCR, RPA | zookeeper | internal |
| 4567-4571/tcp, 15072/udp | APP, BEP Master, BEP Agents, OCR, OCRWIN, RPA, BI | logstash | internal |
| 9200/tcp | APP | ElasticSearch | internal |
| 9092/tcp | BEP Master, APP | nginx (mTLS proxy for TDS) | internal |
Destination Server: OCR
| Destination port | Source server name | Service name | Access type |
|---|---|---|---|
| 8443/tcp | APP, OCR | nginx (proxy for OCR rest API) | internal |
| 22/tcp | INT | SSH | internal |
Destination Server: OCRWIN
| Destination port | Source server name | Service name | Access type |
|---|---|---|---|
| 8080, 8443/tcp | APP, OCRWIN | nginx (proxy for OCR rest API) | internal |
| 5986/tcp | INT | WinRM | internal |
Destination Server: BEP Master
| Destination port | Source server name | Service name | Access type |
|---|---|---|---|
| 8080, 8443/tcp | APP | nginx (proxy for AutoML services APIs) | internal |
| 8480/tcp | BEP Agent, APP | nginx (proxy for marathon) | internal |
| 5050/tcp | BEP Agent, APP | mesos-master | internal |
| 9000-61000/tcp+udp | BEP Agent, INT | mesos-master, filebeat, heartbeat, metricbeat | internal |
| 111/tcp+udp | BEP Agent | NFS | internal |
| 1039/tcp+udp | BEP Agent | NFS | internal |
| 1047/tcp+udp | BEP Agent | NFS | internal |
| 1048/tcp+udp | BEP Agent | NFS | internal |
| 2049/tcp+udp | BEP Agent | NFS | internal |
| 20048/tcp+udp | BEP Agent | NFS | internal |
| 22/tcp | INT | SSH | internal |
| 9063/tcp | APP | nginx (mTLS proxy for hazelcast server) | internal |
| 9093/tcp | APP | nginx (mTLS proxy for worker-management service) | internal |
| 9073/tcp | APP, RPA, BEP Agent | nginx (mTLS for AutoML gateway-service) | internal |
| 9075/tcp | BEP Master, APP | nginx (mTLS proxy for AutoML model-service) | internal |
| 9076/tcp | BEP Master, APP | nginx (mTLS proxy for AutoML model-management-service) | internal |
| 5702/tcp | APP, BEP Master, BEP Agent(s), RPA | hazelcast server communication port | internal |
| 10506/tcp | BEP Master | Flask worker-management-service port | internal |
Destination Server: BEP Agent(s)
| Destination port | Source server name | Service name | Access type |
|---|---|---|---|
| 5051/tcp | BEP Master | mesos-slave | internal |
| 9000-61000/tcp+udp | BEP Master, INT | mesos-slave, filebeat, heartbeat, metricbeat | internal |
| 22/tcp | INT | SSH | internal |
Destination Server: RPA
| Destination port | Source server name | Service name | Access type |
|---|---|---|---|
| 8080/8443/tcp | APP | nginx (proxy for RPA hub) | internal |
| 5986/tcp | INT | WinRM | internal |
| 3389/tcp | APP | RDP | internal |
Destination Server: BI
| Destination port | Source server name | Service name | Access type |
|---|---|---|---|
| 80, 443/tcp | all | Apache (proxy for Tableau Web Interface) | internal |
| 5986/tcp | INT | WinRM | internal |
Destination Server: MSSQL
| Destination port | Source server name | Service name | Access type |
|---|---|---|---|
| 1433 | all | MS SQL | internal |
Additional ports for external NFS server
If you plan to use an external NFS server, open the following ports besides the ones earlier:
| Source server | Destination server | Destination port | Service name | Access type |
|---|---|---|---|---|
| All servers | NFS | 111/tcp+udp | NFS | internal |
| All servers | NFS | 2049/tcp+udp | NFS | internal |
In case you have STATD_PORT, LOCKD_TCPPORT, and LOCKD_UDPPORT statically defined on your NFS server, make sure that traffic is allowed from all IA Cloud servers towards these ports on the NFS server. Otherwise, make sure that traffic is allowed from all IAC servers towards port range 1024 - 65535 on the NFS server.
Additional ports for HA mode
If you install the Product in the high-availability, besides the ports above, open the following ones.
Destination Server: APP (Control Tower)
| Destination port | Source server name | Service name | Access type |
|---|---|---|---|
| 80, 443/tcp | LB | /Control Tower, WorkSpace, Bot Manager, AutoQC, Nexus, Minio, Kibana, OCR, Mesos, Marathon, RabbitMQ | internal |
| 7083/tcp | LB | Control Tower (mTLS) | internal |
| 5553/tcp | LB | Bot Manager (mTLS) | internal |
| 9092/tcp | LB | Task Dispatcher Service | internal |
| 9093/tcp | LB | Worker Management Service | internal |
| 9073/tcp | LB | AutoML Gateway Service | internal |
| 9075/tcp | LB | AutoML Model Service | internal |
| 9076/tcp | LB | AutoML Model Management Service | internal |
| 4083/tcp | LB | AutoQC | internal |
| 8200/tcp | LB | Vault | internal |
| 9200/tcp | LB | ElasticSearch | internal |
Destination Server: INT
| Destination port | Source server name | Service name | Access type |
|---|---|---|---|
| 2181/tcp, 2888-3888/tcp | INT | zookeeper cluster | internal |
| 9300/tcp | INT | ElasticSearch cluster | internal |
| 8201/tcp | INT | Vault cluster | internal |
| 2888,3888/tcp | INT | Zookeeper cluster services | internal |
| 4369,25672/tcp | INT | RabbitMQ discovery services | internal |
| 35672-35682/tcp | INT | RabbitMQ discovery services | internal |
| 9300 | INT | Elasticsearch cluster services | internal |
Destination Server: LB
| Destination port | Source server name | Service name | Access type |
|---|---|---|---|
| 80, 443/tcp | all | Control Tower, WorkSpace, Bot Manager, AutoQC, Nexus, Minio, Kibana, OCR, Mesos, Marathon, RabbitMQ | external and internal |
| 7083/tcp | APP, INT, BEP Agents, RPA, OCR | Control Tower (mTLS) | internal |
| 5553/tcp | APP, INT, RPA, BEP Master, BEP Agents, OCR | Bot Manager (mTLS) | internal |
| 9092/tcp | APP, INT, BEP Master, BEP Agents, OCR | Task Dispatcher Service | internal |
| 9093/tcp | APP, INT, BEP Master, BEP Agents, OCR | Worker Management Service | internal |
| 9073/tcp | APP, INT, BEP Master, RPA, BEP Agents, OCR | AutoML Gateway Service | internal |
| 9075/tcp | APP, INT, BEP Master, BEP Agents, OCR | AutoML Model Service | internal |
| 9076/tcp | APP, INT, BEP Master, BEP Agents, OCR | AutoML Model Management Service | internal |
| 4083/tcp | APP, INT, BEP Master, BEP Agents, OCR | AutoQC | internal |
| 8200/tcp | all | Vault | internal |
| 9200/tcp | APP, INT, BEP Master, BEP Agents, MSSQL, OCR | ElasticSearch | internal |
WorkFusion URLs
APP (in non-HA mode) or LoadBalancer (in HA mode):
- https://workfusion_lb_hostname – Control Tower
- https://workspace_lb_hostname/workspace – WorkSpace
- https://kibana_lb_hostname/kibana/ – Kibana
- https://minio_lb_hostname/minio – Minio (S3 emulator)
- https://nexus_lb_hostname/nexus – Nexus
- https://rabbitmq_lb_hostname – RabbitMQ API Web UI
- https://mesos_lb_hostname – Mesos
- https://marathon_lb_hostname – Marathon
- https://ocr_lb_hostname – OCR Rest API
- https://bi_lb_hostname – Tableau web interface