> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/installation/rpm/rpm-single-node/ports.md).

# Ports

What must be reachable on a single-node deployment — two ports for users, and everything else internal to the host.

**A single-node deployment exposes two ports.** Everything else the platform uses stays on the host and is reached over the loopback interface.

## What users need to reach

<table><thead><tr><th width="128.19998168945312">Port</th><th width="124.99996948242188">Protocol</th><th>Purpose</th></tr></thead><tbody><tr><td><strong>80</strong></td><td>TCP</td><td>The reverse proxy. Every user interface is served through it</td></tr><tr><td><strong>443</strong></td><td>TCP</td><td>The same, once you serve the platform over HTTPS — see <a href="/installation/rpm/rpm-single-node/enable-https.md"><em>Enable HTTPS</em></a></td></tr></tbody></table>

**The installation opens both for you** when you install the reverse proxy and firewalld is running.

Users reach the platform at `http://<your-hostname>/webconsole`, or `https://` once you have completed [*Enable HTTPS*](/installation/rpm/rpm-single-node/enable-https.md).

## What stays on the host

Every other port belongs to a component talking to another component on the same host. **Do not open these in your firewall.** They are listed so you can confirm nothing else on the host already holds one, and so you recognise them when reading `ss -lntp` or running a check from [*Start and verify*](/installation/rpm/rpm-single-node/start-and-verify.md).

<table><thead><tr><th width="168.40000915527344">Port</th><th>Component</th></tr></thead><tbody><tr><td>8080</td><td>Interface router — the reverse proxy's backend. Reach it directly only when diagnosing on the host</td></tr><tr><td>8081</td><td>Identity provider</td></tr><tr><td>8082</td><td>Webconsole</td></tr><tr><td>8083</td><td>Self-service</td></tr><tr><td>8084</td><td>Self-service, external</td></tr><tr><td>8085</td><td>Report viewer</td></tr><tr><td>8086</td><td>Static interface assets</td></tr><tr><td>9080</td><td>Enterprise service bus</td></tr><tr><td>8182</td><td>Graph engine (JanusGraph)</td></tr><tr><td>8200</td><td>Secret store (Vault)</td></tr><tr><td>8500</td><td>Secret store backend (Consul)</td></tr><tr><td>9042</td><td>Graph storage (Cassandra)</td></tr><tr><td>9200</td><td>Search tier (OpenSearch or Elasticsearch)</td></tr><tr><td>5672, 15672</td><td>Message broker (RabbitMQ)</td></tr><tr><td>6379</td><td>Cache (Redis)</td></tr><tr><td>3306</td><td>Database (MariaDB), where installed locally</td></tr><tr><td>3000, 9090, 9100</td><td>Monitoring, where the optional stack is installed</td></tr></tbody></table>

Confirm they are free before you install:

{% code overflow="wrap" %}

```bash
ss -lntp | grep -E ':(80|443|8080|8081|8082|8083|8084|8085|8086|9080|8182|8200|8500|9042|9200|5672|15672|6379|3306)\b'
```

{% endcode %}

**Expected: no output.** Anything listed is held by another application — resolve that first.

## How a request travels

{% code overflow="wrap" %}

```
browser  ──▶  reverse proxy  ──▶  interface router  ──▶  the six interfaces
   80/443     httpd + mod_openiam        8080             8081 – 8086
                     │
                     └──────────────▶  enterprise service bus
                                              9080
```

{% endcode %}

Only the first hop is reachable from outside the host. Changing any of the internal ports is done in `env.conf` **before** you install — see [*Settings*](/installation/settings.md).

## Database, when it is remote

Open from the platform host to your database server:

<table><thead><tr><th width="244.39999389648438">Port</th><th>Platform</th></tr></thead><tbody><tr><td>3306</td><td>MariaDB, MySQL</td></tr><tr><td>5432</td><td>PostgreSQL</td></tr><tr><td>1433</td><td>Microsoft SQL Server</td></tr><tr><td>1521</td><td>Oracle Database</td></tr></tbody></table>

Only the platform host needs this access. End users never connect to the database.

## Remote connectors

A connector running on another machine — a Windows host managing Active Directory, for example — connects back to the platform's message broker:

| From               | To                | Port                  |
| ------------------ | ----------------- | --------------------- |
| The connector host | The platform host | 5672, or 5671 for TLS |

The connector also needs whatever the system it manages requires: 5986 and 9389 for Active Directory over WinRM and Active Directory Web Services, 636 for LDAPS, 443 for cloud services.

## Outbound

<table><thead><tr><th width="289.0000305175781">Destination</th><th width="176.199951171875">Port</th><th>When</th></tr></thead><tbody><tr><td><code>download.openiam.com</code></td><td>443</td><td>During installation, unless you install air-gapped</td></tr><tr><td>Your vendor's package repositories</td><td>443</td><td>During installation, unless you install air-gapped</td></tr><tr><td>Your mail server</td><td>25, 465 or 587</td><td>For notifications</td></tr><tr><td>Managed systems</td><td>Varies</td><td>Each connector reaches the system it manages</td></tr><tr><td>Your identity providers</td><td>443</td><td>For inbound federation</td></tr></tbody></table>

## Related

* [*System requirements*](/installation/system-requirements.md)
* [*Prepare the host*](/installation/rpm/rpm-single-node/prepare-the-host.md) — confirms these are free
* [*Enable HTTPS*](/installation/rpm/rpm-single-node/enable-https.md)
* [*Settings*](/installation/settings.md) — changing an internal port before you install

*Applies to OpenIAM 2026.8.1.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/installation/rpm/rpm-single-node/ports.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.