> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/installation/rpm/rpm-ha/ports.md).

# Ports

What must be reachable on a three-node deployment — two ports at the load balancer, and the matrix between the three hosts.

**User traffic reaches a three-node deployment on two ports, at the load balancer.** Everything else in this page is traffic between the three hosts, and should be reachable **between those three hosts only**.

## What users need to reach

<table><thead><tr><th width="121.79998779296875">Port</th><th width="114.19998168945312">Protocol</th><th>Purpose</th></tr></thead><tbody><tr><td><strong>80</strong></td><td>TCP</td><td>The reverse proxy on each node. The load balancer distributes to all three</td></tr><tr><td><strong>443</strong></td><td>TCP</td><td>The same, once you serve the platform over HTTPS — see <a href="/installation/rpm/rpm-single-node/enable-https.md"><em>Enable HTTPS</em></a></td></tr></tbody></table>

The cluster installation opens both on each host where firewalld is running, so the load balancer can reach every node. Users reach the load balancer's name, never an individual host's.

## Set these first

The example later on this page uses these:

{% code overflow="wrap" %}

```bash
export NODE1=<first node address>
export NODE2=<second node address>
export NODE3=<third node address>
```

{% endcode %}

## Between the three hosts

**The cluster installation opens these on each host for you**, where firewalld is running. This table matters when a network firewall or a security group sits between the hosts — allow it there before you start, restricted to the three addresses.

<table><thead><tr><th>Port</th><th width="120.79998779296875">Protocol</th><th width="106.39999389648438">Source</th><th>Destination</th><th width="108">Component</th><th>Purpose</th><th>Required</th></tr></thead><tbody><tr><td>22</td><td>TCP</td><td>First node</td><td>All three</td><td>SSH</td><td>The build runs across the cluster from the first node</td><td>Always</td></tr><tr><td>111, 2049, 20048, 32765, 32767</td><td>TCP and UDP</td><td>All three</td><td>The shared-storage node</td><td>Shared storage (NFS)</td><td>The directories common to all three nodes</td><td>Always, unless you supply the shared filesystem yourself</td></tr><tr><td>8300</td><td>TCP</td><td>All three</td><td>All three</td><td>Secret store backend</td><td>Server-to-server RPC and leader election</td><td>Always</td></tr><tr><td>8301, 8302</td><td>TCP and UDP</td><td>All three</td><td>All three</td><td>Secret store backend</td><td>Cluster gossip</td><td>Always</td></tr><tr><td>8500, 8503, 8600</td><td>TCP</td><td>All three</td><td>All three</td><td>Secret store backend</td><td>HTTP and HTTPS API, DNS interface</td><td>Always</td></tr><tr><td>8200</td><td>TCP</td><td>All three</td><td>All three</td><td>Secret store</td><td>Client access, through the component load balancer</td><td>Always</td></tr><tr><td>8201, 8202, 8203</td><td>TCP</td><td>All three</td><td>All three</td><td>Secret store</td><td>Replication between instances</td><td>Always</td></tr><tr><td>9200</td><td>TCP</td><td>All three</td><td>All three</td><td>Search tier</td><td>Client protocol</td><td>Always</td></tr><tr><td>9300</td><td>TCP</td><td>All three</td><td>All three</td><td>Search tier</td><td>Inter-node communication</td><td>Always</td></tr><tr><td>4369</td><td>TCP</td><td>All three</td><td>All three</td><td>Message broker</td><td>Peer discovery</td><td>Always</td></tr><tr><td>5672</td><td>TCP</td><td>All three</td><td>All three</td><td>Message broker</td><td>Client protocol</td><td>Always</td></tr><tr><td>5671</td><td>TCP</td><td>All three</td><td>All three</td><td>Message broker</td><td>Client protocol over TLS</td><td>Only where broker TLS is enabled</td></tr><tr><td>25672</td><td>TCP</td><td>All three</td><td>All three</td><td>Message broker</td><td>Inter-node communication</td><td>Always</td></tr><tr><td>15672, 15671</td><td>TCP</td><td>All three</td><td>All three</td><td>Message broker</td><td>Management interface</td><td>Only if you use it</td></tr><tr><td>6379, 6390</td><td>TCP</td><td>All three</td><td>All three</td><td>Cache</td><td>Replication</td><td>Always</td></tr><tr><td>26379</td><td>TCP</td><td>All three</td><td>All three</td><td>Cache watchers</td><td>Failover coordination</td><td>Always</td></tr><tr><td>7000</td><td>TCP</td><td>All three</td><td>All three</td><td>Graph storage</td><td>Inter-node cluster communication</td><td>Always</td></tr><tr><td>7001</td><td>TCP</td><td>All three</td><td>All three</td><td>Graph storage</td><td>Inter-node cluster communication, TLS</td><td>Only where storage TLS is enabled</td></tr><tr><td>9042, 9142, 9160</td><td>TCP</td><td>All three</td><td>All three</td><td>Graph storage</td><td>Client protocol</td><td>Always</td></tr><tr><td>7199</td><td>TCP and UDP</td><td>Your administration network</td><td>All three</td><td>Graph storage</td><td>Monitoring and management</td><td>Only if you monitor it</td></tr><tr><td>8182</td><td>TCP</td><td>All three</td><td>All three</td><td>Graph engine</td><td>Graph access, node to node</td><td>Always</td></tr><tr><td>3306, 4444, 4567, 4568</td><td>TCP</td><td>All three</td><td>All three</td><td>Database</td><td>Cluster replication</td><td>Only where the database cluster is built on the same three hosts</td></tr><tr><td>8080</td><td>TCP</td><td>All three</td><td>All three</td><td>Interface router</td><td>Reached by the component load balancer on each node</td><td>Always</td></tr><tr><td>9080</td><td>TCP</td><td>All three</td><td>All three</td><td>Enterprise service bus</td><td>Reached by the component load balancer on each node</td><td>Always</td></tr><tr><td>8081 – 8086</td><td>TCP</td><td>Each host</td><td>Itself</td><td>Interface services</td><td>Reached by that node's own interface router</td><td>Always, loopback only</td></tr><tr><td>8087, 9081, 8183, 9201, 5673, 5002</td><td>TCP</td><td>All three</td><td>All three</td><td>Component load balancing</td><td>One front end per clustered tier — <a href="/installation/rpm/rpm-ha/component-load-balancing.md"><em>Component load balancing</em></a></td><td>Always</td></tr><tr><td>3000, 9090, 9100</td><td>TCP</td><td>Your administration network</td><td>All three</td><td>Monitoring</td><td>Dashboards, metrics, node metrics</td><td>Only where the optional monitoring stack is installed</td></tr></tbody></table>

**"All three" means the three cluster hosts and nothing else.** None of these should be reachable from the wider network.

**A worked example.** This opens the always-required TCP ports between the three hosts. It is a starting point, not the whole matrix — add the conditional rows that apply to your deployment, and the UDP rules for gossip and shared storage:

{% code overflow="wrap" expandable="true" %}

```bash
ALWAYS_TCP="22 8300 8301 8302 8500 8503 8600 8200 8201 8202 8203 \
            9200 9300 4369 5672 25672 6379 6390 26379 \
            7000 9042 9142 9160 8182 8080 9080 \
            8087 9081 8183 9201 5673 5002"
UDP_PORTS="8301 8302"

for host in "$NODE2" "$NODE3"; do   # on NODE1; use the other two on each host
  for p in $ALWAYS_TCP; do
    firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=$host \
      port port=$p protocol=tcp accept"
  done
  for p in $UDP_PORTS; do
    firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=$host \
      port port=$p protocol=udp accept"
  done
done
firewall-cmd --reload
```

{% endcode %}

**Shared storage needs its own rules**, including UDP, from all three hosts to the exporting node — ports 111, 2049, 20048, 32765 and 32767.

## Encryption in transit

| Connection                          | Default                                                                                                                 |
| ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| Users to the reverse proxy          | HTTP until you install a certificate; HTTPS after — [*Enable HTTPS*](/installation/rpm/rpm-single-node/enable-https.md) |
| Services to the secret store        | HTTPS, with certificate authentication                                                                                  |
| Secret store between instances      | HTTPS on 8201                                                                                                           |
| Secret store backend, between nodes | Gossip encrypted with a key generated at installation                                                                   |
| Services to the search tier         | HTTPS                                                                                                                   |
| Services to the message broker      | 5672. Use 5671 for TLS                                                                                                  |
| Services to the database            | Follows your database server's configuration                                                                            |

## Remote connectors

A connector running on another machine reaches the cluster's message broker through the component load balancer, so it keeps working when a node is lost:

| From               | To                      | Port                  |
| ------------------ | ----------------------- | --------------------- |
| The connector host | All three cluster nodes | 5673, or 5671 for TLS |

The connector also needs whatever the system it manages requires: 5986 and 9389 for Active Directory over WinRM and Active Directory Web Services, 636 for LDAPS, 443 for cloud services.

## Database, when it is remote

Open from all three hosts to your database server:

<table><thead><tr><th width="228.39999389648438">Port</th><th>Platform</th></tr></thead><tbody><tr><td>3306</td><td>MariaDB, MySQL</td></tr><tr><td>5432</td><td>PostgreSQL</td></tr><tr><td>1433</td><td>Microsoft SQL Server</td></tr><tr><td>1521</td><td>Oracle Database</td></tr></tbody></table>

## Outbound

Only the first node needs outbound access during the build — it retrieves the artefacts once and distributes them to the other two.

<table><thead><tr><th width="308.20001220703125">Destination</th><th width="175">Port</th><th>When</th></tr></thead><tbody><tr><td><code>download.openiam.com</code></td><td>443</td><td>During the build, from the first node</td></tr><tr><td>Your vendor's package repositories</td><td>443</td><td>During the build</td></tr><tr><td>Your mail server</td><td>25, 465 or 587</td><td>For notifications</td></tr><tr><td>Managed systems</td><td>Varies</td><td>Each connector reaches the system it manages</td></tr><tr><td>Your identity providers</td><td>443</td><td>For inbound federation</td></tr></tbody></table>

## Related

* [*Prepare the hosts*](/installation/rpm/rpm-ha/prepare-the-hosts.md)
* [*Component load balancing*](/installation/rpm/rpm-ha/component-load-balancing.md) — what each front end fronts
* [*Configure the load balancer*](/installation/rpm/rpm-ha/load-balancer.md) — what goes in front of the three hosts
* [*System requirements*](/installation/system-requirements.md)

*Applies to OpenIAM 2026.8.1.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/installation/rpm/rpm-ha/ports.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.