Skip to main content

Service Port Map

Use this as a quick reference for the most common ports in the current architecture.

Goal: be explicit about what you should expose to edge networks vs what must stay internal.

Expose Externally (Common)

These are the only ports most deployments should expose outside the cluster/host:

ComponentPortProtocolPurpose
Edge proxy (Ingress/Caddy)443 (and optionally 80)HTTP(S)Web UI + API entrypoint
agent-gateway50052mTLS gRPCEdge agent connectivity (config + control stream + ingestion)

Optional External Ingest Ports (Enable If Used)

Expose these only if you are ingesting telemetry from network devices or external systems. Restrict these ports to known exporter source IPs whenever possible.

CollectorPortProtocolPurpose
Syslog (flowgger)514UDPSyslog ingestion
SNMP traps (trapd)162UDPSNMP trap ingestion
NetFlow2055UDPNetFlow v5/v9
IPFIX4739UDPIPFIX
OTLP (otel)4317OTLPOTEL ingestion (optional)
OTLP (otel)4318OTLP/HTTPOTEL ingestion (optional)

Internal-Only (Do Not Expose To Edge Networks)

These ports are for internal service-to-service traffic and should not be reachable from edge networks:

ComponentPortProtocolNotes
web-ng4000HTTPServe behind proxy/ingress only
core-elx8090HTTPServe behind proxy/ingress only
CNPG5432TCPDatabase (use port-forward/VPN for admin access)
NATS4222TCPJetStream client port (internal)
NATS monitoring8222HTTPInternal only
NATS cluster6222TCPInternal only
ERTS distribution4369, 9100-9155TCPNever expose outside the cluster/host network

Notes

  • Keep NATS internal unless you explicitly need external access.
  • web-ng and core-elx should not be exposed directly; use Caddy or an ingress controller.
  • Kubernetes: services are ClusterIP by default; only agent-gateway (and optional collectors) should be LoadBalancer/NodePort.
  • Docker Compose defaults:
    • agent-gateway binds to 127.0.0.1:50052 unless you set GATEWAY_PUBLIC_BIND=0.0.0.0.
    • CNPG binds to 127.0.0.1:${CNPG_PUBLIC_PORT:-5455} unless you set CNPG_PUBLIC_BIND=0.0.0.0.

For TLS setup, see TLS Security.