Ports
Open the following ports on the servers. The same open ports must be specified in the ports.yml file later during the installation.
The following table lists the default ports for each application component.
Access types:
- external—for end-users
- internal—for internal application communication
We highly recommend to keep all servers of your WorkFusion IA Cloud environment in the same single subnet with restricted EXTERNAL access to this subnet (which means close all ports from outside the subnet) and NON-restricted internal access between servers (which means keep all ports open between all servers within the subnet) to allow communication between product components located on different hosts between each other. To ensure network security, consider using firewalls in your network to block requests outside the subnet where your environment is located.
To ensure that the end users can interract with the product, on the APP server, open specific ports (by default, 80/443, but you can change them, if needed) externally. For the high-availability mode, 80/443 must be open only on a Load Balancer.
This is the easiest and yet secure way to ensure that your data and application are secure from the network perspective.
The table below describes which ports on which servers are used for communication between components.
If you decide to configure firewall rules granularly per each network-interface (for each server) using IPTables or FirewallD on each server there is a high risk of human factor mistake because of the huge amount of such rules for each host. It is easy to forget to open some specific port FROM some specific server TO some specific server. In this case installation may fail in unpredictable places which are difficult for troubleshooting, or product will not work properly. That's why the recommended approach of securing your network is to use dedicated secured subnet with open internal communication, and closed external requests.
See tab Basic setup or HA setup and update from earlier versions, depending on your installation way. On the specified servers (column Destination server), open the ports (column Destination Port) to the required servers (column Source server). If the Source server cell contains "All servers", you must open the corresponding port in both ways: to and from ALL existing servers, including the destination server.
In case of the basic installation, open the following ports:
| Source server | Destination server | Destination port | Service name | Access type | Description |
|---|---|---|---|---|---|
| All servers | APP | 80, 443/tcp | HAProxy (proxy for Control Tower, WorkSpace, bot-manager, AutoQC, Nexus, Minio, Tinymce, Kibana) | external | The main product port for accessing from browser |
| 2181/tcp | zookeeper | internal | Listens to 0.0.0.0 (ZK). Zookeeper port | ||
| 4567-4571/tcp, 15072/tcp | logstash | internal | Listens to 0.0.0.0 (HTTPS). Logstash port | ||
| 5672/tcp | RabbitMQ queue | internal | Listens to 0.0.0.0 (TLS ecrtypted AMQP). RabbitMQ message Queue port | ||
| 8202/tcp | HAProxy (proxy for Vault) | internal | Listens to 0.0.0.0 (HTTPS). HAPROXY and Load Balancer port for Vault | ||
| APP | APP | 22/tcp | SSH | internal | SSH port listening to all linux servers. Used by installer in single-point installation |
| 4084/tcp | nginx (mTLS proxy for SQC) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests using http to localhost's `sqc_port` | ||
| 8200/tcp | Vault (secure store) | internal | Listens to 0.0.0.0 (HTTPS). Hashicorp Vault port | ||
| 8443/tcp | nginx (proxy for Control Tower, WorkSpace, bot-manager, AutoQC, Nexus, Minio, Tinymce, Kibana) | internal | Listens to 0.0.0.0. Nginx HTTPS port. Used to proxy requests from Haproxy (from lb_port_ssl) to destination product components | ||
| 9063/tcp | nginx (mTLS proxy for hazelcast server) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to `hazelcast_server_app_port` | ||
| 9075/tcp | nginx (mTLS proxy for AutoML model-service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to `ams_port` | ||
| 9076/tcp | nginx (mTLS proxy for AutoML model-management-service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to `amms_port` | ||
| 9092/tcp | nginx (mTLS proxy for the task dispatcher service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests from to `tds_port`. Validates client certs | ||
| 9093/tcp | nginx (mTLS proxy for worker-management service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to `wms_port` | ||
| 9200/tcp | ElasticSearch | internal | Listens to 0.0.0.0 (HTTPS). Elasticsearch port | ||
| 45672/tcp | nginx (proxy for RabbitMQ API) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to `rabbitmq_api_port` | ||
| APP, BEP Agent | APP | 8480/tcp | nginx (proxy for marathon) | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Marathon Port |
| 5050/tcp | mesos-master | internal | Listens to 0.0.0.0 (HTTPS). Mesos master port | ||
| BEP Agent | APP | 32768-61000/tcp+udp | mesos-master, filebeat, heartbeat, metricbeat | internal | For communication between mesos master, mesos agents, filebeat, heartbeat, and metricbeat |
| 111/tcp+udp | NFS | internal | Don't change it. NFS portmap TCP/UDP port. Used by internal NFS server only in non-HA mode, and only when `nfs_enabled: True` | ||
| 2049/tcp+udp | NFS | internal | Don't change it. NFS daemon TCP/UDP port. Used by internal NFS server only in non-HA mode, and only when `nfs_enabled: True` | ||
| 20048/tcp+udp | NFS | internal | Don't change it. NFS mountd TCP/UDP port. Used by internal NFS server only in non-HA mode, and only when `nfs_enabled: True` | ||
| APP, RPA, BEP Agent | APP | 9073/tcp | nginx (mTLS for AutoML gateway-service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to `ags_port` |
| 9702/tcp | hazelcast server communication port | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Hazelcast server port | ||
| APP | OCR | 8443/tcp | nginx (proxy for OCR rest API) | internal | Listens to 0.0.0.0. Nginx HTTPS port. Used to proxy requests from Haproxy (from `lb_port_ssl`) to destination product components |
| 22/tcp | SSH | internal | SSH port listening on all linux servers. Used by installer in single-point installation | ||
| APP, BEP Agent | BEP Agents | 5051/tcp | mesos-slave | internal | Listens to 0.0.0.0 (HTTPS). Mesos Agent port |
| APP | 32768-61000/tcp+udp | mesos-slave, filebeat, heartbeat, metricbeat | internal | For communication between mesos master, mesos agents, filebeat, heartbeat, and metricbeat | |
| 22/tcp | SSH | internal | SSH port listening on all linux servers. Used by installer in single-point installation | ||
| APP | RPA | 8443/tcp | nginx (proxy for RPA hub) | internal | Listens to 0.0.0.0. Nginx HTTPS port. Used to proxy requests from Haproxy (from lb_port_ssl) to destination product components |
| 5986/tcp | WinRM | internal | Windows Remote Management (WinRM) HTTPS port listening to Windows servers. Used by installer in single-point installation | ||
| 3389/tcp | RDP | internal | Listens to 0.0.0.0 (RDP). Remote Desktop port. Used by bot manager to login into RPA server | ||
| All servers | BI | 80, 443/tcp | Apache (proxy for Tableau Web Interface) | external | The main product port for accessing from browser |
| APP | BI | 5986/tcp | WinRM | internal | Windows Remote Management (WinRM) HTTPS port listening to Windows servers. Used by installer in single-point installation |
| All servers | MSSQL | 1433 | MS SQL | internal | MS SQL Server port |
If you are planning to install IA Cloud Enterprise in the high-availability mode or update the product from a previous version, open the following ports:
| Source server | Destination server | Destination port | Service name | Access type | Description |
|---|---|---|---|---|---|
| All servers | APP | 80, 443/tcp | HAProxy (proxy for Control Tower, WorkSpace, bot-manager, AutoQC, Nexus, Minio, Tinymce, Kibana) | external | The main product port for accessing from browser. In the HA mode, the external Load Balancer must use it |
| 8202/tcp | HAProxy (proxy for Vault) | internal | Listens to 0.0.0.0 (HTTPS). HAPROXY and Load Balancer port for Vault | ||
| BI | 80, 443/tcp | Apache (proxy for Tableau Web Interface) | external | The main product port for accessing from browser. In the HA mode, the external Load Balancer must use it | |
| INT | 2181/tcp | Zookeeper | internal | Listens to 0.0.0.0 (ZK). Zookeeper port | |
| 4567-4571/tcp, 15072/tcp | logstash | internal | Listens to 0.0.0.0 (HTTPS). Logstash port | ||
| 5672/tcp | RabbitMQ queue | internal | Listens to 0.0.0.0 (TLS ecrtypted AMQP). RabbitMQ message Queue port | ||
| LB | 80/tcp | Control Tower, WorkSpace, Bot Manager, AutoQC, Nexus, Minio, Kibana, OCR, Mesos, Marathon, RabbitMQ | external | Used only by browser for redirect to `lb_port_ssl` (port 443) | |
| 443/tcp | Control Tower (mTLS), Bot Manager (mTLS), Task Dispatcher Service, Worker Management Service, AutoML Gateway Service, AutoML Model Service, AutoML Model Management Service, AutoQC, Nexus, Minio, Kibana, OCR, Mesos, Marathon, RabbitMQ | external | The main product port for accessing from browser. In the HA mode, the external Load Balancer must use it | ||
| 8202/tcp | Vault | internal | Listens to 0.0.0.0 (HTTPS). HAPROXY and Load Balancer port for Vault | ||
| MSSQL | 1433 | MS SQL | internal | MS SQL Server port | |
| APP | APP | 22/tcp | SSH | internal | SSH port listening on all linux servers. Used by installer in single-point installation |
| 4084/tcp | nginx (mTLS proxy for SQC) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests using http to localhost's `sqc_port` | ||
| 8443/tcp | nginx (proxy for Control Tower, WorkSpace, bot-manager, AutoQC, Nexus, Minio, Tinymce, Kibana) | internal | Listens to 0.0.0.0. Nginx HTTPS port. Used to proxy requests from Haproxy (from lb_port_ssl) to destination product components | ||
| BEP Agents | 22/tcp | SSH | internal | SSH port listening on all linux servers. Used by installer in single-point installation | |
| BEP Master | 22/tcp | SSH | internal | SSH port listening on all linux servers. Used by installer in single-point installation | |
| 5050/tcp | mesos-master | internal | Listens to 0.0.0.0 (HTTPS). Mesos master port | ||
| 8480/tcp | nginx (proxy for marathon) | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Marathon Port | ||
| 9073/tcp | nginx (mTLS for AutoML gateway-service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to `ags_port` | ||
| 9075/tcp | nginx (mTLS proxy for AutoML model-service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to `ams_port` | ||
| 9076/tcp | nginx (mTLS proxy for AutoML model-management-service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to `amms_port` | ||
| 9063/tcp | nginx (mTLS proxy for hazelcast server) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to `hazelcast_server_app_port` | ||
| 9093/tcp | nginx (mTLS proxy for worker-management service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to `wms_port` | ||
| 9702/tcp | hazelcast server communication port | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Hazelcast server port | ||
| BI | 5986/tcp | WinRM | internal | Windows Remote Management (WinRM) HTTPS port listening to Windows servers. Used by installer in single-point installation | |
| INT | 22/tcp | SSH | internal | SSH port listening on all linux servers. Used by installer in single-point installation | |
| 8200/tcp | Vault (secure store) | internal | Listens to 0.0.0.0 (HTTPS). Hashicorp Vault port | ||
| 8443/tcp | nginx (proxy for Nexus, Minio and RabbitMQ API) | internal | Listens to 0.0.0.0. Nginx HTTPS port. Used to proxy requests from Haproxy (from lb_port_ssl) to destination product components | ||
| 9092/tcp | nginx (mTLS proxy for the task dispatcher service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests from to `tds_port`. Validates client certs | ||
| 9200/tcp | ElasticSearch | internal | Listens to 0.0.0.0 (HTTPS). Elasticsearch port | ||
| 45672/tcp | nginx (proxy for RabbitMQ API) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to `rabbitmq_api_port` | ||
| OCR | 22/tcp | SSH | internal | SSH port listening on all linux servers. Used by installer in single-point installation | |
| 8443/tcp | nginx (proxy for OCR rest API) | internal | Listens to 0.0.0.0. Nginx HTTPS port. Used to proxy requests from Haproxy (from lb_port_ssl) to destination product components | ||
| RPA | 3389/tcp | RDP | internal | Listens to 0.0.0.0 (RDP). Remote Desktop port. Used by bot manager to login into RPA server | |
| 5986/tcp | WinRM | internal | Windows Remote Management (WinRM) HTTPS port listening to Windows servers. Used by installer in single-point installation | ||
| 8443/tcp | nginx (proxy for RPA hub) | internal | Listens to 0.0.0.0. Nginx HTTPS port. Used to proxy requests from Haproxy (from lb_port_ssl) to destination product components | ||
| BEP Agent | BEP Agents | 5051/tcp | mesos-slave | internal | Listens to 0.0.0.0 (HTTPS). Mesos Agent port |
| BEP Master | 111/tcp+udp | NFS | internal | Don't change it. NFS portmap TCP/UDP port. Used by internal NFS server only in non-HA mode, and only when `nfs_enabled: True` | |
| 2049/tcp+udp | NFS | internal | Don't change it. NFS daemon TCP/UDP port. Used by internal NFS server only in non-HA mode, and only when ``nfs_enabled: True` | ||
| 5050/tcp | mesos-master | internal | Listens to 0.0.0.0 (HTTPS). Mesos master port | ||
| 8480/tcp | nginx (proxy for marathon) | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Marathon Port | ||
| 9073/tcp | nginx (mTLS for AutoML gateway-service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to `ags_port` | ||
| 9702/tcp | hazelcast server communication port | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Hazelcast server port | ||
| 20048/tcp+udp | NFS | internal | Don't change it. NFS mountd TCP/UDP port. Used by internal NFS server only in non-HA mode, and only when `nfs_enabled: True` | ||
| 32768-61000/tcp+udp | mesos-master, filebeat, heartbeat, metricbeat | internal | For communication between mesos master, mesos agents, filebeat, heartbeat, and metricbeat | ||
| BEP Master | BEP Agents | 5051/tcp | mesos-slave | internal | Listens to 0.0.0.0 (HTTPS). Mesos Agent port |
| 15000/tcp | Marathon communication port | internal | Listens to 0.0.0.0 (HTTPS). Used for communication between Marathon nodes | ||
| 32768-61000/tcp+udp | mesos-slave, filebeat, heartbeat, metricbeat | internal | For communication between mesos master, mesos agents, filebeat, heartbeat, and metricbeat | ||
| BEP Master | 9702/tcp | hazelcast server communication port | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Hazelcast server port | |
| 9075/tcp | nginx (mTLS proxy for AutoML model-service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to `ams_port` | ||
| 9076/tcp | nginx (mTLS proxy for AutoML model-management-service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to `amms_port` | ||
| INT | 9092/tcp | nginx (mTLS proxy for the task dispatcher service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests from to `tds_port`. Validates client certs | |
| INT | APP | 8443/tcp | nginx (proxy for Control Tower, WorkSpace, bot-manager, AutoQC, Nexus, Minio, Tinymce, Kibana) | internal | Listens to 0.0.0.0. Nginx HTTPS port. Used to proxy requests from Haproxy (from lb_port_ssl) to destination product components |
| BEP Agents | 32768-61000/tcp+udp | mesos-slave, filebeat, heartbeat, metricbeat | internal | For communication between mesos master, mesos agents, filebeat, heartbeat, and metricbeat | |
| BEP Master | 32768-61000/tcp+udp | mesos-master, filebeat, heartbeat, metricbeat | internal | For communication between mesos master, mesos agents, filebeat, heartbeat, and metricbeat | |
| INT | 2888,3888/tcp | Zookeeper cluster services | internal | Listen to 0.0.0.0 (TCP). Zookeeper peers use port 2888 to connect to other peers, and ZK uses port 3888 for leader election. Because the default leader election also uses TCP, Zookeeper cannot use the same "zookeeper_cluster_port" for this. Thus it is required to have another port for leader election | |
| 4369,25672/tcp 35672-35682/tcp | RabbitMQ discovery services | internal | Listen to 0.0.0.0 (TCP). Ports for the RabbitMQ cluster | ||
| 9200/tcp | ElasticSearch | internal | Listens to 0.0.0.0 (HTTPS). Elasticsearch port | ||
| 9300 | Elasticsearch cluster services | internal | Listens to 0.0.0.0 (HTTPS). Elasticsearch port to bind for communication between nodes in the HA mode | ||
| LB | APP | 80, 443/tcp | Control Tower, WorkSpace, Bot Manager, AutoQC, Nexus, Minio, Kibana, OCR, Mesos, Marathon, RabbitMQ | internal | The main product port for accessing from browser. In the HA mode, the external Load Balancer must use it |
| 8202/tcp | Vault | internal | Listens to 0.0.0.0 (HTTPS). HAPROXY and Load Balancer port for Vault | ||
| RPA | BEP Master | 9073/tcp | nginx (mTLS for AutoML gateway-service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to `ags_port` |
| 9702/tcp | hazelcast server communication port | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Hazelcast server port |
Additional ports for working with Mesos and Marathon Web UI
If you plan to access Mesos' web interface (for example, to download worker logs), open the following ports for external access. For the security reasons, you may allow access only from particular IP addresses, for example, developer or operator workstations, which use this functionality:
| Source server(s) | Destination server(s) | Destination port | Service name | Access type | | ---------------- | --------------------- | ---------------- || ------------- | ----------- | | Operators workstations | APP server(s) | 5050 | mesos-master | external | | Operators workstations | Bepagent server(s) | 5051 | mesos-agent | external |
If you plan to access Marathon web interface (for example, to monitor workers or view their configuration), open the following ports for external access. For the security reasons, you may allow access only from particular IP addresses, for example, developer or operator workstations, which use this functionality:
| Source server(s) | Destination server(s) | Destination port | Service name | Access type | | ---------------- | --------------------- | ---------------- ||------------- | ----------- | | Operators workstations | APP server(s) | 8480 |mesos-master | external |
Additional ports for external NFS server
If you plan to use an external NFS server, open the following ports besides the ones earlier:
| Source server | Destination server | Destination port | Service name | Access type |
|---|---|---|---|---|
| All servers | NFS | 111/tcp+udp | NFS | internal |
| All servers | NFS | 2049/tcp+udp | NFS | internal |
note
In case you have MOUNTD_PORT, STATD_PORT, LOCKD_TCPPORT, and LOCKD_UDPPORT statically defined on your NFS server, make sure that traffic is allowed from all IA Cloud servers towards these ports on the NFS server. Otherwise, make sure that traffic is allowed from all IAC servers towards port range 1024 - 65535 on the NFS server.
Additional ports for AD logins on MSSQL server
If you plan to use Active Directory logins for the MSSQL server available from version 10.1.6.1, open the following ports to be accessible from all servers to the domain controller server (all of them, if you have multiple):
| Source server(s) | Destination server(s) | Destination port | Protocol | Service name | Access type |
|---|---|---|---|---|---|
| All servers | Domain controller(s) | 53 | UDP | DNS | internal |
| All servers | Domain controller(s) | 88 | UDP / TCP | Kerberos | internal |
| All servers | Domain controller(s) | 389 | TCP | LDAP | internal |
WorkFusion URLs
APP (in non-HA mode) or LoadBalancer (in HA mode):
- https://workfusion_lb_hostname – Control Tower
- https://workspace_lb_hostname/workspace – WorkSpace
- https://kibana_lb_hostname/kibana/ – Kibana
- https://minio_lb_hostname/minio – Minio (S3 emulator)
- https://nexus_lb_hostname/nexus – Nexus
- https://rabbitmq_lb_hostname – RabbitMQ API Web UI
- https://mesos_lb_hostname – Mesos
- https://marathon_lb_hostname – Marathon
- https://ocr_lb_hostname – OCR Rest API
- https://bi_lb_hostname – Tableau web interface