Ports
Open the following ports on the servers. The same open ports must be specified in the ports.yml file later during the installation.
The following table lists the default ports for each application component.
Access types:
- External for end-users
- Internal for internal application communication
Keep all IA Cloud environment servers in the same single subnet with restricted EXTERNAL access to this subnet (close all ports from outside the subnet) and NON-restricted internal access between servers (keep all ports open between all servers within the subnet). Such an approach allows communication between product components located on different hosts between each other. To ensure network security, consider using firewalls in your network to block requests outside the subnet where your environment is located.
To ensure that end-users can interact with the Product, on the Master server, open specific ports externally. By default, the ports are 80 and 443, but you can change them if needed. For the high-availability mode, 80 and 443 must be open only on a Load Balancer.
This is the easiest and secure way to ensure that your data and application are protected from the network perspective.
The table below describes which ports on which servers are used for communication between components.
Suppose you decide to configure firewall rules granularly per each network interface (for each server) using IPTables or FirewallD on each server. In that case, there is a high risk of human factor mistakes caused by multiple rules for each host. It is easy to forget to open some specific port FROM some specific server TO some particular server. In this case, installation may fail in unpredictable places which are difficult for troubleshooting, or the Product will not work correctly. That's why the recommended approach of securing your network is to use a dedicated secured subnet with open internal communication and closed external requests.
Default ports
See tab Basic setup or HA setup and update from earlier versions, depending on your installation method. On the specified servers (column Destination server), open the ports (column Destination Port) to the required servers (column Source server). If the Source server cell contains "All servers", you must open the corresponding port both ways: to and from ALL existing servers, including the destination server.
- For basic setup
- For high-availability setup and update from earlier versions
In case of the basic installation, open the following ports:
| Source server | Destination server | Destination port | Service name | Access type | Description |
|---|---|---|---|---|---|
| All servers | Master | 80, 443/tcp | HAProxy (proxy for Control Tower, Workspace, bot-manager, AutoQC, Nexus, Minio, Tinymce, Kibana) | external | The main product port for accessing from browser |
| All servers | Master | 2181/tcp | ZooKeeper | internal | Listens to 0.0.0.0 (ZK). ZooKeeper port. |
| All servers | Master | 2281/tcp | ZooKeeper | internal | Listens to 0.0.0.0 (ZK). ZooKeeper secure port. |
| All servers | Master | 4567-4571/tcp, 15072-15073/tcp | logstash | internal | Listens to 0.0.0.0 (HTTPS). Logstash port. |
| All servers | Master | 5672/tcp | RabbitMQ queue | internal | Listens to 0.0.0.0 (TLS ecrtypted AMQP). RabbitMQ message Queue port. |
| All servers | Master | 8202/tcp | HAProxy (proxy for Vault) | internal | Listens to 0.0.0.0 (TCP). HAPROXY and Load Balancer port for Vault. |
| All servers | BI | 80, 443/tcp | Apache (proxy for Tableau Web Interface) | external | The main product port for accessing from the browser |
| All servers | MSSQL | 1433 | MS SQL | internal | MS SQL Server port |
| Master | Master | 7373/tcp | KES | internal | Only for 10.2.4.2. Listens to 0.0.0.0 (HTTPS). KES port. |
| Master | Master | 7374/tcp | HAProxy (proxy for KES) | internal | Only for 10.2.4.2. Listens to 0.0.0.0 (TCP). HAPROXY and Load Balancer port for KES. |
| Master | Agent | 22/tcp | SSH | internal | SSH port listening on all Linux servers. Used by the installer in a single-point installation. |
| Master | Agent | 5051/tcp | mesos-slave | internal | Listens to 0.0.0.0 (HTTPS). Mesos Agent port. |
| Master | Agent | 40000-44000/tcp | mesos-slave | internal | Listens on 0.0.0.0 (HTTPS). Port range on Mesos Agent(s) used for communication with Mesos Master. |
| Master | BI | 5986/tcp | WinRM | internal | Windows Remote Management (WinRM) HTTPS port listening to Windows servers. Used by the installer in a single-point installation. |
| Master | RPA | 5986/tcp | WinRM | internal | Windows Remote Management (WinRM) HTTPS port listening to Windows servers. Used by the installer in a single-point installation. |
| Master | RPA | 8443/tcp | nginx (proxy for RPA hub) | internal | Listens to 0.0.0.0. Nginx HTTPS port. Used to proxy requests from Haproxy (from lb_port_ssl) to destination product components. |
| Agent | Master | 111/tcp+udp | NFS | internal | Don't change it. NFS portmap TCP and UDP port. Used by internal NFS server only in non-HA mode, and only when nfs_enabled: True |
| Agent | Master | 2049/tcp+udp | NFS | internal | Don't change it. NFS daemon TCP and UDP port. Used by internal NFS server only in non-HA mode, and only when nfs_enabled: True |
| Agent | Master | 5050/tcp | mesos-master | internal | Listens to 0.0.0.0 (HTTPS). Mesos master port. |
| Agent | Master | 8480/tcp | nginx (proxy for marathon) | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Marathon Port. |
| Agent | Master | 9073/tcp | nginx (mTLS for AutoML gateway-service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to ags_port. |
| Agent | Master | 9702/tcp | hazelcast server communication port | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Hazelcast server port. |
| Agent | Master | 20048/tcp+udp | NFS | internal | Don't change it. NFS mountd TCP and UDP port. Used by internal NFS server only in non-HA mode, and only when nfs_enabled: True |
| Agent | Agent | 5051/tcp | mesos-slave | internal | Listens to 0.0.0.0 (HTTPS). Mesos Agent port. |
| Agent | Agent | 40000-44000/tcp | mesos-slave | internal | Listens on 0.0.0.0 (HTTPS). Port range on Mesos Agent(s) used for communication with Mesos Master. |
| RPA | Master | 9073/tcp | nginx (mTLS for AutoML gateway-service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to ags_port. |
| RPA | Master | 9702/tcp | hazelcast server communication port | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Hazelcast server port. |
If you are planning to install IA Cloud Enterprise in the high-availability mode or update the Product from previous versions, open the following ports:
| Source server | Destination server | Destination port | Service name | Access type | Description |
|---|---|---|---|---|---|
| All servers | Master | 80, 443/tcp | HAProxy (proxy for Control Tower, Workspace, bot-manager, AutoQC, Nexus, Minio, Tinymce, Kibana) | external | The main product port for accessing from the browser. In the HA mode, the external Load Balancer must use it. |
| All servers | Master | 2181/tcp | ZooKeeper | internal | Listens to 0.0.0.0 (ZK). ZooKeeper port. |
| All servers | Master | 2281/tcp | ZooKeeper | internal | Listens to 0.0.0.0 (ZK). ZooKeeper secure port. |
| All servers | Master | 4567-4571/tcp, 15072-15073/tcp | logstash | internal | Listens to 0.0.0.0 (HTTPS). Logstash port. |
| All servers | Master | 5672/tcp | RabbitMQ queue | internal | Listens to 0.0.0.0 (TLS ecrtypted AMQP). RabbitMQ message Queue port. |
| All servers | Master | 8202/tcp | HAProxy (proxy for Vault) | internal | Listens to 0.0.0.0 (HTTPS). HAPROXY and Load Balancer port for Vault. |
| All servers | BI | 80, 443/tcp | Apache (proxy for Tableau Web Interface) | external | The main product port for accessing from the browser. In the HA mode, the external Load Balancer must use it. |
| All servers | LB | 80/tcp | Control Tower, Workspace, Bot Manager, AutoQC, Nexus, Minio, Kibana, OCR, Mesos, Marathon, RabbitMQ | external | Used only by the browser for redirect to lb_port_ssl (port 443). |
| All servers | LB | 443/tcp | Control Tower (mTLS), Bot Manager (mTLS), Task Dispatcher Service, Worker Management Service, AutoML Gateway Service, AutoML Model Service, AutoML Model Management Service, AutoQC, Nexus, Minio, Kibana, OCR, Mesos, Marathon, RabbitMQ | external | The main product port for accessing from the browser. In the HA mode, the external Load Balancer must use it. |
| All servers | LB | 7374/tcp | HAProxy (proxy for KES) | internal | Only for 10.2.4.2. Listens to 0.0.0.0 (TCP). HAPROXY and Load Balancer port for KES. |
| All servers | LB | 8202/tcp | Vault | internal | Listens to 0.0.0.0 (HTTPS). HAPROXY and Load Balancer port for Vault. |
| All servers | MSSQL | 1433 | MS SQL | internal | MS SQL Server port |
| Master | Master | 22/tcp | SSH | internal | SSH port listening on all linux servers. Used by installer in single-point installation. |
| Master | Master | 2379/tcp | ETCD | internal | Listens to 0.0.0.0 (HTTPS). ETCD server port. |
| Master | Master | 2380/tcp | ETCD | internal | Listens to 0.0.0.0 (HTTPS). ETCD cluster port. |
| Master | Master | 2888,3888/tcp | ZooKeeper cluster services | internal | Listens to 0.0.0.0 (TCP). ZooKeeper peers use port 2888 to connect to other peers, and ZK uses port 3888 for leader election. Because the default leader election also uses TCP, ZooKeeper cannot use the same "zookeeper_cluster_port" for this. Thus, it is required to have another port for leader election. |
| Master | Master | 4084/tcp | nginx (mTLS proxy for SQC) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests using http to localhost's sqc_port. |
| Master | Master | 4369,25672/tcp 35672-35682/tcp | RabbitMQ discovery services | internal | Listens to 0.0.0.0 (TCP). Ports for the RabbitMQ cluster. |
| Master | Master | 5050/tcp | mesos-master | internal | Listens to 0.0.0.0 (HTTPS). Mesos master port. |
| Master | Master | 5051/tcp | mesos-slave | internal | Listens to 0.0.0.0 (HTTPS). Mesos Agent port. |
| Master | Master | 7373/tcp | KES | internal | Only for 10.2.4.2. Listens to 0.0.0.0 (HTTPS). KES port. |
| Master | Master | 7374/tcp | HAProxy (proxy for KES) | internal | Only for 10.2.4.2. Listens to 0.0.0.0 (TCP). HAPROXY and Load Balancer port for KES. |
| Master | Master | 7600/tcp | Keycloak cluster services | internal | Listens to 0.0.0.0 (HTTPS). Used for Keycloak in tcpping protocol. |
| Master | Master | 8200/tcp | Vault (secure store) | internal | Listens to 0.0.0.0 (HTTPS). Hashicorp Vault port. |
| Master | Master | 8443/tcp | nginx (proxy for Control Tower, Workspace, bot-manager, AutoQC, Nexus, Minio, Tinymce, Kibana, and RabbitMQ API) | internal | Listens to 0.0.0.0. Nginx HTTPS port. Used to proxy requests from Haproxy (from lb_port_ssl) to destination product components. |
| Master | Master | 8480/tcp | nginx (proxy for marathon) | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Marathon Port. |
| Master | Master | 9063/tcp | nginx (mTLS proxy for hazelcast server) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to hazelcast_server_app_port. |
| Master | Master | 9073/tcp | nginx (mTLS for AutoML gateway-service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to ags_port. |
| Master | Master | 9075/tcp | nginx (mTLS proxy for AutoML model-service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to ams_port. |
| Master | Master | 9076/tcp | nginx (mTLS proxy for AutoML model-management-service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to amms_port. |
| Master | Master | 9092/tcp | nginx (mTLS proxy for the task dispatcher service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests from to tds_port. Validates client certs. |
| Master | Master | 9093/tcp | nginx (mTLS proxy for worker-management service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to wms_port. |
| Master | Master | 9200/tcp | ElasticSearch | internal | Listens to 0.0.0.0 (HTTPS). Elasticsearch port. |
| Master | Master | 9300 | Elasticsearch cluster services | internal | Listens to 0.0.0.0 (HTTPS). Elasticsearch port to bind for communication between nodes in the HA mode. |
| Master | Master | 9702/tcp | hazelcast server communication port | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Hazelcast server port. |
| Master | Master | 15000/tcp | Marathon communication port | internal | Listens to 0.0.0.0 (HTTPS). Used for communication between Marathon nodes. |
| Master | Master | 45672/tcp | nginx (proxy for RabbitMQ API) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to rabbitmq_api_port. |
| Master | Master | 32768-61000/tcp+udp | mesos-master, filebeat, heartbeat, metricbeat | internal | For communication between the Mesos master, Mesos agents, Filebeat, Heartbeat, and Metricbeat |
| Master | Agent | 5051/tcp | mesos-slave | internal | Listens to 0.0.0.0 (HTTPS). Mesos Agent port. |
| Master | Agent | 22/tcp | SSH | internal | SSH port listening on all Linux servers. Used by the installer in a single-point installation. |
| Master | Agent | 32768-61000/tcp+udp | mesos-slave, filebeat, heartbeat, metricbeat | internal | For communication between the Mesos master, Mesos agents, Filebeat, Heartbeat, and Metricbeat |
| Master | BI | 5986/tcp | WinRM | internal | Windows Remote Management (WinRM) HTTPS port listening to Windows servers. Used by the installer in a single-point installation. |
| Master | RPA | 5986/tcp | WinRM | internal | Windows Remote Management (WinRM) HTTPS port listening to Windows servers. Used by the installer in a single-point installation. |
| Master | RPA | 8443/tcp | nginx (proxy for RPA hub) | internal | Listens to 0.0.0.0. Nginx HTTPS port. Used to proxy requests from Haproxy (from lb_port_ssl) to destination product components. |
| Agent | Agent | 5051/tcp | mesos-slave | internal | Listens to 0.0.0.0 (HTTPS). Mesos Agent port. |
| Agent | Master | 111/tcp+udp | NFS | internal | Don't change it. NFS portmap TCP and UDP port. Used by the internal NFS server only in the non-HA mode and only when nfs_enabled: True |
| Agent | Master | 2049/tcp+udp | NFS | internal | Don't change it. NFS daemon TCP and UDP port. Used by the internal NFS server only in the non-HA mode and only when `nfs_enabled: True |
| Agent | Master | 5050/tcp | mesos-master | internal | Listens to 0.0.0.0 (HTTPS). Mesos master port. |
| Agent | Master | 8480/tcp | nginx (proxy for marathon) | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Marathon Port. |
| Agent | Master | 9073/tcp | nginx (mTLS for AutoML gateway-service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to ags_port. |
| Agent | Master | 9702/tcp | hazelcast server communication port | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Hazelcast server port. |
| Agent | Master | 20048/tcp+udp | NFS | internal | Don't change it. NFS mountd TCP and UDP port. Used by internal NFS server only in non-HA mode, and only when nfs_enabled: True |
| Agent | Master | 32768-61000/tcp+udp | mesos-master, filebeat, heartbeat, metricbeat | internal | For communication between the Mesos master, Mesos agents, Filebeat, Heartbeat, and Metricbeat |
| LB | Master | 80, 443/tcp | Control Tower, Workspace, Bot Manager, AutoQC, Nexus, Minio, Kibana, OCR, Mesos, Marathon, RabbitMQ | internal | The main product port for accessing from the browser. In the HA mode, the external Load Balancer must use it. |
| LB | Master | 8202/tcp | Vault | internal | Listens to 0.0.0.0 (HTTPS). HAPROXY and Load Balancer port for Vault. |
| LB | Master | 7374/tcp | HAProxy (proxy for KES) | internal | Only for 10.2.4.2. Listens to 0.0.0.0 (TCP). HAPROXY and Load Balancer port for KES. |
| RPA | Master | 9073/tcp | nginx (mTLS for AutoML gateway-service) | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to ags_port. |
| RPA | Master | 9702/tcp | hazelcast server communication port | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Hazelcast server port. |
Ports for Mesos and Marathon Web UI
If you plan to access the Marathon web interface (for example, to monitor workers or view their configuration), open the following ports for external access. For security reasons, you can allow access only from particular IP addresses, for example, developer, or operator workstations, using this feature:
| Source server | Destination server | Destination port | Service name | Access type |
|---|---|---|---|---|
| Operators workstations | Master server(s) | 8480 | mesos-master | external |
Ports for external NFS server
If you plan to use an external NFS server, open the following ports in addition to the ones mentioned earlier:
| Source server | Destination server | Destination port | Service name | Access type |
|---|---|---|---|---|
| All servers | NFS | 111/tcp+udp | NFS | internal |
| All servers | NFS | 2049/tcp+udp | NFS | internal |
In case you have MOUNTD_PORT, STATD_PORT, LOCKD_TCPPORT, and LOCKD_UDPPORT statically defined on your NFS server, make sure that traffic is allowed from all IA Cloud servers towards these ports on the NFS server. Otherwise, ensure that traffic is permitted from all IAC servers towards the port range 1024 to 65535 on the NFS server.
WorkFusion URLs
Master (in non-HA mode) or LoadBalancer (in HA mode):
https://workfusion_lb_hostname: Control Towerhttps://workspace_lb_hostname/workspace: Workspacehttps://kibana_lb_hostname/kibana/: Kibanahttps://minio_lb_hostname/minio: MinIO (S3 emulator)https://nexus_lb_hostname/nexus: Nexushttps://rabbitmq_lb_hostname: RabbitMQ API Web UIhttps://mesos_lb_hostname: Mesoshttps://marathon_lb_hostname: Marathonhttps://ocr_lb_hostname: OCR Rest APIhttps://bi_lb_hostname: Tableau web interfacehttps://keycloak_lb_hostname: Keycloak web interface