Networking and ports
Every port XPLG listens on or calls out to — the V7 console, listeners and pull sources, the X8 role port model, the Traefik edge — and where to place the deployment in your network.
What you will do: open the ports between users, sources, cluster nodes and dock, and nothing else.
XPLG runs inside your network and conforms to your zoning: core, DMZ or segregated OT segments, with collection points in protected segments and only authenticated, encrypted, one-directional flows between zones. No inbound internet exposure is required and there is no call-home channel carrying content. Firewalls, proxies, DNS and TLS termination are your infrastructure and outside XPLG support, which gives advisory guidance only; see Support terms.
V7: ports
| Port | Direction | Purpose |
|---|---|---|
| 30303 TCP | Inbound | HTTP console, the product API and SDK, Remote XPLG connections between instances; set to 0 under Settings > System Settings to disable plain HTTP |
| 30443 TCP | Inbound | HTTPS console (self-signed certificate by default; see TLS certificates) |
| 30304 / 30444 TCP | Inbound | A second instance on the same machine (server.xml.processor); every further instance needs its own ports |
| AJP connector | From the load balancer | mod_jk traffic to a UI node (the wiki's server.xml example uses 8011); the AJP and shutdown ports are also set with the SDK |
| 514 UDP | Inbound | Syslog listener (events up to 1,024 bytes) |
| 1468 TCP | Inbound | Syslog over TCP (events up to 8,192 bytes) |
| 2055 UDP | Inbound | NetFlow v5 and v9 collector |
| Console port | Inbound | HTTP/S listener for Fluent Bit, Logstash and any shipper posting JSON to /logeye/api/logger.jsp; the token in the URL is the authentication |
| 22 TCP | Outbound | SSH, SFTP or SCP pull from Linux and UNIX hosts; by default seven sessions per connection and about three sessions per log type (Connection Policies) |
| 389 / 636 TCP | Outbound | LDAP or LDAPS for Active Directory sign-in |
| 9092 / 9093 TCP | Outbound | Kafka listener to the brokers (plain / TLS; Azure Event Hubs on 9093 with SASL_SSL) |
| 443 TCP | Outbound | Cloud APIs (Azure AD and Office 365, S3, cloud storage), Teams, Slack and PagerDuty alerts, and the heartbeat to dock.xplg.com |
| SMTP | Outbound | E-mail alerts to your mail server |
Windows Events and UNC paths are read over the Windows network from a Windows node or a Windows Agent Mode instance; the wiki lists no port numbers for them. Several listener accounts can run on one machine as long as each uses its own port. The console ports can be changed in the GUI or with the SDK (-api settings -httpPort … -sslPort … -ajpPort … -shutdownPort …).
Only a few features need the internet — Teams, Office 365 and Azure AD, PagerDuty, Slack — and they can go through a proxy set in the lax file (-Dhttps.proxyHost, -Dhttps.proxyPort, -DproxySet=true); everything else works without it. Sites with no outbound route at all are on Air-gapped.
X8: the port model
All roles use host networking: the port a role binds is the port it is reached and advertised on, unique per server and reused across servers. Every value below is a default, overridable per cluster with {ROLE}_{KIND}_PORT (MASTER_HTTP_PORT, UI_HAZELCAST_PORT, PROCESSOR_IGNITE_NET_PORT, …).
| Role | HTTP | HTTPS | Ignite discovery | Hazelcast | Ignite client | REST | Ingest (TCP and UDP) |
|---|---|---|---|---|---|---|---|
| master | 30308 | 30448 | 13344 | 11473 | 10800 | 10300 | 1468–1472 |
| ui | 30304 | 30444 | 13345 | 11474 | 10801 | 10301 | 1479–1483 |
| listener | 30305 | 30445 | 13346 | 11475 | 10802 | 10302 | 1484–1488 |
| processor | 30306 | 30446 | 13347 | 11476 | 10803 | 10303 | 1489–1493 |
| processor-1 | 30307 | 30447 | 13348 | 11477 | 10804 | 10304 | 1494–1498 |
| Traefik edge | 80, 443 (ui pool) | — | — | — | — | — | 30303, 30443 (master pool), 8304–8308 (per-role consoles) |
- Ignite and Hazelcast traffic is direct host to host between servers and never goes through Traefik; a seed IP that is not reachable on these ports is the usual cause of a role that starts but never opens its console (see Clusters and performance).
xplg-preflight.shchecks every TCP and UDP port the active profiles need../xplg-open-ports.sh --profiles master,server --listprints the model without root;sudo ./xplg-open-ports.sh ./.envopens it (firewalld, ufw, nftables or iptables, idempotent); add--source <cidr>to restrict it to the cluster subnet in production,--profiles master,server,traefikon the server that runs the edge,--dry-runto preview and--removewith the same options to undo.- Cloud firewalls are separate: a host rule cannot override an AWS Security Group, an Azure NSG or a DigitalOcean Cloud Firewall — open the same ports there. Rootful Docker publishes ports through the
natDOCKERchain and bypasses ufw's INPUT rules, so published ports may answer before you open anything; keep the host rules anyway so audits and the preflight agree with reality. - The shared
/home/datamount is NFSv4 between every server and your NFS server;/node/datastays local. - The Traefik dashboard runs with
api.insecure— bind it to loopback in production.
Checks
ss -ltnp # what listens on this host (Linux) curl -k https://<host>:30443/logeye/ # V7 console: 200 or 302 curl http://<host>:30304/ # X8 ui role ./verify.sh # X8: every role port, every Traefik entry, the sticky cookie
A result of 000 from verify.sh means nothing listens on that port; 503 means Traefik is up but no backend is healthy yet.
Next: TLS certificates
Source: XPLG wiki, pages 3150807046, 3150774276, 3150544899, 3151659011, 3180101636, 1707180033, 1594132078, 1595637847, 1595637849, 1595637851, 1599570150, 1600094131, 1730052097, 1598685522, 1598685520, 1594133390, 1594753047, 1683849221, 1594133322, 1597014018, 1594133404, 1702690910, 1594132180, 3162013701, 1594131939 (https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/3150807046).
