Open the following ports on the servers. The same open ports must be specified in the config.yml file later during the installation.
The following table lists the default ports for each application component.
Access types:
external – for end-users
internal – for internal application communication
We highly recommend to keep all servers of your WorkFusion IA Cloud environment in the same single subnet with restricted EXTERNAL access to this subnet (which means close all ports from outside the subnet) and NON-restricted internal access between servers (which means keep all ports open between all servers within the subnet) to allow communication between product components located on different hosts between each other.
To ensure network security, consider using firewalls in your network to block requests outside the subnet where your environment is located.
To ensure that the end users can interract with the product, on the APP server, open specific ports (by default, 80/443, but you can change them, if needed) externally. For the high-availability mode, 80/443 must be open only on a Load Balancer.
This is the easiest and yet secure way to ensure that your data and application are secure from the network perspective.
The table below describes which ports on which servers are used for communication between components.
If you decide to configure firewall rules granularly per each network-interface (for each server) using IPTables or FirewallD on each server there is a high risk of human factor mistake because of the huge amount of such rules for each host. It is easy to forget to open some specific port FROM some specific server TO some specific server. In this case installation may fail in unpredictable places which are difficult for troubleshooting, or product will not work properly.
That's why the recommended approach of securing your network is to use dedicated secured subnet with open internal communication, and closed external requests.
See tab Basic setup or HA setup and update from earlier versions, depending on your installation way.
Read the tables in the following way: on the specified servers (section Destination Server: <name>), open the ports (column Destination Port) to the required servers (column Source Server Name). If the Source server name cell contains "all", you must open the corresponding port in both ways: to ALL servers and from ALL servers.
For basic setup
For high-availability setup and update from earlier versions
In case of the basic installation, open the following ports:
Destination Server: APP (Control Tower)
Destination port
Source server name
Service name
Access type
80, 443/tcp
all
HAProxy (proxy for Control Tower, WorkSpace, bot-manager, AutoQC, Nexus, Minio, Tinymce, Kibana)
external and internal
8443/tcp
APP, INT
nginx (proxy for Control Tower, WorkSpace, bot-manager, AutoQC, Nexus, Minio, Tinymce, Kibana)
internal
8202/tcp
all
HAProxy (proxy for Vault)
internal
4084/tcp
APP
nginx (mTLS proxy for SQC)
internal
22/tcp
APP
SSH
internal
Destination Server: INT
Destination port
Source server name
Service name
Access type
8443/tcp
APP
nginx (proxy for Nexus, Minio and RabbitMQ API)
internal
8200/tcp
APP
Vault (secure store)
internal
45672/tcp
APP
nginx (proxy for RabbitMQ API)
internal
5672/tcp
all
RabbitMQ queue
internal
2181/tcp
all
zookeeper
internal
4567-4571/tcp, 15072/tcp
all
logstash
internal
9200/tcp
APP, INT
ElasticSearch
internal
9092/tcp
BEP Master, APP
nginx (mTLS proxy for the task dispatcher service)
internal
22/tcp
APP
SSH
internal
Destination Server: OCR
Destination port
Source server name
Service name
Access type
8443/tcp
APP
nginx (proxy for OCR rest API)
internal
22/tcp
APP
SSH
internal
Destination Server: OCRWIN
Destination port
Source server name
Service name
Access type
8443/tcp
APP
nginx (proxy for OCR rest API)
internal
5986/tcp
APP
WinRM
internal
Destination Server: BEP Master
Destination port
Source server name
Service name
Access type
8480/tcp
APP, BEP Agent
nginx (proxy for marathon)
internal
5050/tcp
APP, BEP Agent
mesos-master
internal
32768-61000/tcp+udp
BEP Agent, INT
mesos-master, filebeat, heartbeat, metricbeat
internal
111/tcp+udp
BEP Agent
NFS
internal
2049/tcp+udp
BEP Agent
NFS
internal
20048/tcp+udp
BEP Agent
NFS
internal
22/tcp
APP
SSH
internal
9063/tcp
APP
nginx (mTLS proxy for hazelcast server)
internal
9093/tcp
APP
nginx (mTLS proxy for worker-management service)
internal
9073/tcp
APP, RPA, BEP Agent
nginx (mTLS for AutoML gateway-service)
internal
9075/tcp
APP, BEP Master
nginx (mTLS proxy for AutoML model-service)
internal
9076/tcp
APP, BEP Master
nginx (mTLS proxy for AutoML model-management-service)
internal
9702/tcp
APP, BEP Master, BEP Agent, RPA
hazelcast server communication port
internal
Destination Server: BEP Agent(s)
Destination port
Source server name
Service name
Access type
5051/tcp
BEP Master, BEP Agent
mesos-slave
internal
32768-61000/tcp+udp
BEP Master, INT
mesos-slave, filebeat, heartbeat, metricbeat
internal
22/tcp
APP
SSH
internal
Destination Server: RPA
Destination port
Source server name
Service name
Access type
8443/tcp
APP
nginx (proxy for RPA hub)
internal
5986/tcp
APP
WinRM
internal
3389/tcp
APP
RDP
internal
Destination Server: BI
Destination port
Source server name
Service name
Access type
80, 443/tcp
all
Apache (proxy for Tableau Web Interface)
external and internal
5986/tcp
APP
WinRM
internal
Destination Server: MSSQL
Destination port
Source server name
Service name
Access type
1433
all
MS SQL
internal
If you planning to install IA Cloud Enterprise in the high-availability mode or update the product from version 10.x to 10.1.4, open the following ports:
Destination Server: APP
Destination port
Source server name
Service name
Access type
80, 443/tcp
all
HAProxy (proxy for Control Tower, WorkSpace, bot-manager, AutoQC, Nexus, Minio, Tinymce, Kibana)
external and internal
8443/tcp
APP, INT
nginx (proxy for Control Tower, WorkSpace, bot-manager, AutoQC, Nexus, Minio, Tinymce, Kibana)
Control Tower (mTLS), Bot Manager (mTLS), Task Dispatcher Service, Worker Management Service, AutoML Gateway Service, AutoML Model Service, AutoML Model Management Service, AutoQC, Nexus, Minio, Kibana, OCR, Mesos, Marathon, RabbitMQ
external and internal
8202/tcp
all
Vault
internal
Additional ports for external NFS server
If you plan to use an external NFS server, open the following ports besides the ones earlier:
Destination port
Source server name
Service name
Access type
111/tcp+udp
all
NFS
internal
2049/tcp+udp
all
NFS
internal
In case you have STATD_PORT, LOCKD_TCPPORT, and LOCKD_UDPPORT statically defined on your NFS server, make sure that traffic is allowed from all IA Cloud servers towards these ports on the NFS server. Otherwise, make sure that traffic is allowed from all IAC servers towards port range 1024 - 65535 on the NFS server.
WorkFusion URLs
APP (in non-HA mode) or LoadBalancer (in HA mode):
