Ports
Open the following ports on the servers. The same ports must be specified in the ports.yml file later during installation.
The following table lists the default ports for each application component.
Access types:
- External: used by end users
- Internal: used for internal application communication
Keep all Work.AI environment servers in the same subnet. Restrict external access to this subnet by closing all ports from outside the subnet and allow unrestricted internal access between servers by keeping all ports open within the subnet. This approach enables product components located on different hosts to communicate with each other. To ensure network security, consider using firewall rules to block requests from outside the subnet where your environment is located.
To ensure that end users can interact with the Product, open specific ports externally on the Master server. By default, the ports are 80 and 443, but you can change them if needed. In high-availability mode, 80 and 443 must be open only on the load balancer.
This is the easiest and most secure way to protect your data and application from the network perspective.
The table below describes which ports are used on which servers for communication between components.
If you decide to configure firewall rules granularly for each network interface on each server by using IPtables or FirewallD, there is a high risk of human error caused by multiple rules for each host. It is easy to forget to open a specific port from a specific server to another specific server. In this case, installation may fail at unpredictable points that are difficult to troubleshoot, or the Product may not work correctly. That is why the recommended approach to securing your network is to use a dedicated secured subnet with open internal communication and closed external requests.
Default ports
See tab Basic setup or HA setup and update from earlier versions, depending on your installation method. On the specified servers (column Destination server), open the ports (column Destination Port) to the required servers (column Source server). If the Source server cell contains "All servers", you must open the corresponding port both ways: to and from ALL existing servers, including the destination server.
In case of the basic installation, open the following ports:
- Basic setup
- High-availability setup
| Source server | Destination server | Destination port | Service name | Access type | Description |
|---|---|---|---|---|---|
| All servers | Master | 80, 443/tcp | HAProxy | external | The main product port for accessing from the browser |
| 2181/tcp | ZooKeeper | internal | Listens to 0.0.0.0 (ZK). ZooKeeper port. | ||
| 2281/tcp | ZooKeeper | internal | Listens to 0.0.0.0 (ZK). ZooKeeper secure port. | ||
| 4567-4571/tcp, 15072-15073/tcp | logstash | internal | Listens to 0.0.0.0 (HTTPS). Logstash port. | ||
| 5672/tcp | RabbitMQ | internal | Listens to 0.0.0.0 (TLS ecrtypted AMQP). RabbitMQ message queue port. | ||
| 8202/tcp | HAProxy | internal | Listens to 0.0.0.0 (TCP). HAProxy and Load Balancer port for Vault. | ||
| MSSQL | 1433 | MS SQL | internal | MS SQL Server port. | |
| Agent | 22/tcp | SSH | internal | SSH port listening on all Linux servers. Used by the installer in a Quick installation. | |
| 5051/tcp | mesos-slave | internal | Listens to 0.0.0.0 (HTTPS). Mesos Agent port. | ||
| 40000-44000/tcp | mesos-slave | internal | Listens on 0.0.0.0 (HTTPS). Port range on Mesos Agent(s) used for communication with Mesos Master. | ||
| RPA | 5986/tcp | WinRM | internal | Windows Remote Management (WinRM) HTTPS port listening to Windows servers. Used by the installer in a Quick installation. | |
| 8443/tcp | Nginx | internal | Nginx HTTPS port. Used to proxy requests from HAProxy (from lb_port_ssl) to destination product components. | ||
| Superset | 22/tcp | SSH | internal | SSH port listening on all Linux servers. Used by the installer in a Quick installation. | |
| 8443/tcp | Nginx | internal | Nginx HTTPS port. Used to proxy requests from HAProxy (from lb_port_ssl) to destination product components. | ||
| Agent | Master | 111/tcp+udp | NFS | internal | Don't change it. NFS portmap TCP/UDP port. Used by the internal NFS server only in the non-HA mode and only when nfs_enabled: True. |
| 2049/tcp+udp | NFS | internal | Don't change it. NFS daemon TCP/UDP port. Used by the internal NFS server only in the non-HA mode and only when nfs_enabled: True. | ||
| 5050/tcp | mesos-master | internal | Listens to 0.0.0.0 (HTTPS). Mesos Master port. | ||
| 8480/tcp | Nginx | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Marathon port. | ||
| 9073/tcp | Nginx | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to ags_port. | ||
| 9702/tcp | hazelcast | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Hazelcast server port. | ||
| 20048/tcp+udp | NFS | internal | Don't change it. NFS mountd TCP/UDP port. Used by the internal NFS server only in the non-HA mode and only when nfs_enabled: True. | ||
| Agent | 5051/tcp | mesos-slave | internal | Listens to 0.0.0.0 (HTTPS). Mesos Agent port. | |
| 40000-44000/tcp | mesos-slave | internal | Listens on 0.0.0.0 (HTTPS). Port range on Mesos Agent(s) used for communication with Mesos Master. | ||
| RPA | Master | 9073/tcp | Nginx | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to ags_port. |
| 9702/tcp | hazelcast | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Hazelcast server port. | ||
| 2379/tcp | etcd | internal | Listens to 0.0.0.0 (HTTPS). ETCD server port. | ||
| Superset | Superset | 9089/tcp | Podman | internal | Access to the Superset container from Nginx. |
| 6379/tcp | Podman | internal | Access to the Redis container from the Superset container. |
If you are planning to install Work.AI in the high-availability mode or update the Product from previous versions, open the following ports:
| Source server | Destination server | Destination port | Service name | Access type | Description |
|---|---|---|---|---|---|
| All servers | Master | 80, 443/tcp | HAProxy | external | The main product port for accessing from the browser. In the HA mode, the external Load Balancer must use it. |
| 2181/tcp | ZooKeeper | internal | Listens to 0.0.0.0 (ZK). ZooKeeper port. | ||
| 2281/tcp | ZooKeeper | internal | Listens to 0.0.0.0 (ZK). ZooKeeper secure port. | ||
| 4567-4571/tcp, 15072-15073/tcp | logstash | internal | Listens to 0.0.0.0 (HTTPS). Logstash port. | ||
| 5672/tcp | RabbitMQ | internal | Listens to 0.0.0.0 (TLS ecrtypted AMQP). RabbitMQ message queue port. | ||
| 8202/tcp | HAProxy | internal | Listens to 0.0.0.0 (HTTPS). HAProxy and Load Balancer port for Vault. | ||
| LB | 80/tcp | HAProxy | external | Used only by the browser for redirect to lb_port_ssl (port 443). | |
| 443/tcp | HAProxy | external | The main product port for accessing from the browser. In the HA mode, the external Load Balancer must use it. | ||
| 8202/tcp | Vault | internal | Listens to 0.0.0.0 (HTTPS). HAProxy and Load Balancer port for Vault. | ||
| MSSQL | 1433 | MS SQL | internal | MS SQL Server port | |
| Master | Master | 22/tcp | SSH | internal | SSH port listening on all Linux servers. Used by the installer in a Quick installation. |
| 2379/tcp | ETCD | internal | Listens to 0.0.0.0 (HTTPS). ETCD server port. | ||
| 2380/tcp | ETCD | internal | Listens to 0.0.0.0 (HTTPS). ETCD cluster port. | ||
| 2888,3888/tcp | ZooKeeper | internal | Listens to 0.0.0.0 (TCP). ZooKeeper peers use port 2888 to connect to other peers, and ZK uses port 3888 for leader election. As the default leader election also uses TCP, ZooKeeper cannot use the same "zookeeper_cluster_port" for this. Thus, it is required to have another port for leader election. | ||
| 4369,25672/tcp 35672-35682/tcp | RabbitMQ | internal | Listens to 0.0.0.0 (TCP). Ports for the RabbitMQ cluster. | ||
| 5050/tcp | mesos-master | internal | Listens to 0.0.0.0 (HTTPS). Mesos Master port. | ||
| 5051/tcp | mesos-slave | internal | Listens to 0.0.0.0 (HTTPS). Mesos Agent port. | ||
| 7600/tcp | Keycloak | internal | Listens to 0.0.0.0 (HTTPS). Used for Keycloak in the tcpping protocol. | ||
| 8200/tcp | Vault | internal | Listens to 0.0.0.0 (HTTPS). Hashicorp Vault port. | ||
| 7480/tcp | S3 | internal | Listens to 0.0.0.0 (TCP). Ceph S3 port. | ||
| 3300,6789/tcp | S3 | internal | Listens to 0.0.0.0 (TCP). Ceph monitor (control plane) port. | ||
| 9100-9200/tcp | S3 | internal | Listens to 0.0.0.0 (TCP). Ceph OSD (data plane) port. | ||
| 6800-6801/tcp | S3 | internal | Listens to 0.0.0.0 (TCP). Ceph MGR (management plane) port. | ||
| 8443/tcp | Nginx | internal | Listens to 0.0.0.0. Nginx HTTPS port. Used to proxy requests from HAProxy (from lb_port_ssl) to destination product components. | ||
| 8480/tcp | Nginx | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Marathon port. | ||
| 9063/tcp | Nginx | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to hazelcast_server_app_port. | ||
| 9200/tcp | ElasticSearch | internal | Listens to 0.0.0.0 (HTTPS). Elasticsearch port. | ||
| 9300/tcp | ElasticSearch | internal | Listens to 0.0.0.0 (HTTPS). Elasticsearch port to bind for communication between nodes in the HA mode. | ||
| 9702/tcp | hazelcast | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Hazelcast server port. | ||
| 15000/tcp | Marathon | internal | Listens to 0.0.0.0 (HTTPS). Used for communication between Marathon nodes. | ||
| 9064/tcp | Nginx | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to rabbitmq_api_port. | ||
| 32768-61000/tcp+udp | mesos | internal | For communication between the Mesos Master, Mesos Agents, Filebeat, Heartbeat, and Metricbeat | ||
| Agent | 5051/tcp | mesos-slave | internal | Listens to 0.0.0.0 (HTTPS). Mesos Agent port. | |
| 22/tcp | SSH | internal | SSH port listening on all Linux servers. Used by the installer in a Quick installation. | ||
| 32768-61000/tcp+udp | mesos | internal | For communication between the Mesos Master, Mesos Agents, Filebeat, Heartbeat, and Metricbeat. | ||
| RPA | 5986/tcp | WinRM | internal | Windows Remote Management (WinRM) HTTPS port listening to Windows servers. Used by the installer in a Quick installation. | |
| 8443/tcp | Nginx | internal | Listens to 0.0.0.0. Nginx HTTPS port. Used to proxy requests from HAProxy (from lb_port_ssl) to destination product components. | ||
| Superset | 22/tcp | SSH | internal | SSH port listening on all Linux servers. Used by the installer in a Quick installation. | |
| 8443/tcp | Nginx | internal | Listens to 0.0.0.0. Nginx HTTPS port. Used to proxy requests from HAProxy (from lb_port_ssl) to destination product components. | ||
| Agent | Agent | 5051/tcp | mesos-slave | internal | Listens to 0.0.0.0 (HTTPS). Mesos Agent port. |
| Master | 111/tcp+udp | NFS | internal | Don't change it. NFS portmap TCP/UDP port. Used by the internal NFS server only in the non-HA mode and only when nfs_enabled: True. | |
| 2049/tcp+udp | NFS | internal | Don't change it. NFS daemon TCP/UDP port. Used by the internal NFS server only in the non-HA mode and only when nfs_enabled: True. | ||
| 5050/tcp | mesos-master | internal | Listens to 0.0.0.0 (HTTPS). Mesos Master port. | ||
| 8480/tcp | Nginx | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Marathon port. | ||
| 9073/tcp | Nginx | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to ags_port. | ||
| 9702/tcp | hazelcast | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Hazelcast server port. | ||
| 20048/tcp+udp | NFS | internal | Don't change it. NFS mountd TCP/UDP port. Used by the internal NFS server only in the non-HA mode and only when nfs_enabled: True. | ||
| 32768-61000/tcp+udp | mesos | internal | For communication between the Mesos Master, Mesos Agents, Filebeat, Heartbeat, and Metricbeat. | ||
| LB | Master | 80, 443/tcp | Haproxy | internal | The main product port for accessing from the browser. In the HA mode, the external Load Balancer must use it. |
| 8202/tcp | Vault | internal | Listens to 0.0.0.0 (HTTPS). HAProxy and Load Balancer port for Vault. | ||
| RPA | Master | 9073/tcp | Nginx | internal | Listens to 0.0.0.0 (HTTPS). Nginx port. Proxies requests to ags_port. |
| 9702/tcp | hazelcast | internal | Don't change it. Listens to 0.0.0.0 (HTTPS). Hazelcast server port. | ||
| Superset | Superset | 9089/tcp | Podman | internal | Access to the Superset container from Nginx. |
| 6379/tcp | Podman | internal | Access to the Redis container from the Superset container. |
Ports for Mesos and Marathon Web UI
If you plan to access the Marathon web interface (for example, to monitor workers or view their configuration), open the following ports for external access. For security reasons, you can allow access only from particular IP addresses, for example, developer, or operator workstations, using this feature:
| Source server | Destination server | Destination port | Service name | Access type |
|---|---|---|---|---|
| Operators workstations | Master server(s) | 8480 | mesos-master | external |
Ports for external NFS server
If you plan to use an external NFS server, open the following ports in addition to the ones mentioned earlier:
| Source server | Destination server | Destination port | Service name | Access type |
|---|---|---|---|---|
| All servers | NFS | 111/tcp+udp | NFS | internal |
| All servers | NFS | 2049/tcp+udp | NFS | internal |
In case you have MOUNTD_PORT, STATD_PORT, LOCKD_TCPPORT, and LOCKD_UDPPORT statically defined on your NFS server, make sure that traffic is allowed from all Work.AI servers towards these ports on the NFS server. Otherwise, ensure that traffic is permitted from all Work.AI servers towards the port range 1024 - 65535 on the NFS server.
WorkFusion URLs
Master (in non-HA mode) or LoadBalancer (in HA mode):
https://workfusion_lb_hostname: Control Towerhttps://workspace_lb_hostname/workspace: Workspacehttps://kibana_lb_hostname/kibana/: Kibanahttps://s3_lb_hostname: S3https://nexus_lb_hostname/nexus: Nexushttps://rabbitmq_lb_hostname: RabbitMQ API Web UIhttps://mesos_lb_hostname: Mesoshttps://marathon_lb_hostname: Marathonhttps://ocr_lb_hostname: OCR REST APIhttps://keycloak_lb_hostname: Keycloak web interface