Service Port Map

Use this as a quick reference for the most common ports in the current architecture.

Goal: be explicit about what you should expose to edge networks vs what must stay internal.

Expose Externally (Common)

These are the only ports most deployments should expose outside the cluster/host:

Component	Port	Protocol	Purpose
Edge proxy (Ingress/Caddy)	443 (and optionally 80)	HTTP(S)	Web UI + API entrypoint
agent-gateway	50052	mTLS gRPC	Edge agent connectivity (config + control stream + ingestion)

Optional External Ingest Ports (Enable If Used)

Expose these only if you are ingesting telemetry from network devices or external systems. Restrict these ports to known exporter source IPs whenever possible.

Collector	Port	Protocol	Purpose
Syslog (serviceradar-log-collector)	514	UDP	Syslog ingestion (UDP)
Syslog TCP (serviceradar-log-collector-tcp)	514	TCP	Syslog ingestion (TCP, optional deployment)
SNMP traps (trapd)	162	UDP	SNMP trap ingestion
NetFlow	2055	UDP	Template-free NetFlow v5 by default. Template-based v9/IPFIX UDP is rejected unless explicitly opted in.
NetFlow / IPFIX (alternate)	4739	UDP	Optional alternate UDP port for the same NetFlow handler. The Helm chart can expose this ipfix service port; route it to an additional netflow listener if used. Template admission follows the same opt-in as 2055.
IPFIX native TLS	4740	TCP	Mutually authenticated native IPFIX. See Flow Collector Scaling and Exporter Authentication.
sFlow	6343	UDP	sFlow
OTLP (otel)	4317	gRPC	OTEL ingestion over OTLP/gRPC (optional). No OTLP/HTTP :4318 endpoint is served.

Kubernetes External Address Map

Keep real deployment addresses in private operations material. Public docs should describe the routing pattern without publishing environment-specific IPs or hostnames:

Traffic	Address	Backend
Web UI/API	<WEB_GATEWAY_ADDRESS>:443/TCP	Shared Gateway HTTPS listener
Syslog	<SYSLOG_GATEWAY_ADDRESS>:514/UDP	Shared Gateway UDPRoute to serviceradar-log-collector
NetFlow	<FLOW_COLLECTOR_ADDRESS>:2055/UDP	serviceradar-flow-collector
IPFIX TLS	<FLOW_COLLECTOR_ADDRESS>:4740/TCP	serviceradar-flow-collector
sFlow	<FLOW_COLLECTOR_ADDRESS>:6343/UDP	serviceradar-flow-collector
SNMP traps	<TRAP_COLLECTOR_ADDRESS>:162/UDP	serviceradar-trapd
BMP	<BMP_COLLECTOR_ADDRESS>:11019/TCP	serviceradar-bmp-collector

Prefer private routing, VPN, firewall allow lists, and source CIDR restrictions for these paths. Do not publish real deployment addresses in public documentation.

Internal-Only (Do Not Expose To Edge Networks)

These ports are for internal service-to-service traffic and should not be reachable from edge networks:

Component	Port	Protocol	Notes
web-ng	4000	HTTP	Serve behind proxy/ingress only; unauthenticated public /metrics requests refused with 401
web-ng metrics	9090	HTTP	Internal Prometheus scrape endpoint (/metrics); omitted from Gateway and Ingress
core-elx	8090	HTTP	Serve behind proxy/ingress only
CNPG	5432	TCP	Database (use port-forward/VPN for admin access)
NATS	4222	TCP	JetStream client port (internal)
NATS monitoring	8222	HTTP	Internal only
NATS cluster	6222	TCP	Internal only
Dgraph Alpha	9080	gRPC	Topology graph (DQL); clients are core and web-ng
Dgraph Alpha HTTP	8080	HTTP	Health and admin endpoints; internal only
Dgraph Zero/Alpha internal	5080, 6080, 7080	TCP	Raft, membership, and Zero admin; never expose
ERTS distribution	4369, 9100-9155	TCP	Never expose outside the cluster/host network

Notes

• Keep NATS internal unless you explicitly need external access.
• web-ng and core-elx should not be exposed directly; use Caddy or an ingress controller.
• Kubernetes: services are ClusterIP by default; only agent-gateway and optional external collectors should be LoadBalancer/NodePort. Syslog can use a shared Gateway API UDP listener instead of a dedicated collector LoadBalancer.
• Docker Compose defaults:
  • agent-gateway binds to 127.0.0.1:50052 unless you set GATEWAY_PUBLIC_BIND=0.0.0.0.
  • CNPG binds to 127.0.0.1:${CNPG_PUBLIC_PORT:-5455} unless you set CNPG_PUBLIC_BIND=0.0.0.0.
  • Dgraph binds to 127.0.0.1:9080 (gRPC) and 127.0.0.1:8080 (HTTP).

For TLS setup, see TLS Security.