Complete Port Matrix and Firewall Rules

This article is intended to assist Customer Experience Engineers, Network Engineers, Field Engineers, with complete port requirements for firewall configuration and network planning for the Crosswork Assurance platform.  Use this guide when configuring firewalls, security groups, or troubleshooting connectivity issues. Getting ports wrong is one of the most common causes of installation failures and connectivity problems.

Network Topology Diagram

This diagram shows the network architecture and how different components communicate. Use it to understand which ports need to be open between which components:

Quick Reference

If you need a quick overview, this table summarizes the port categories. Detailed tables follow for each category:

External Access Ports

These ports must be accessible from outside the cluster for user and administrative access. The specific ports depend on whether you're using DNS mode or No-DNS mode.

DNS Mode (Recommended)

In DNS mode, all applications share port 443 and are differentiated by hostname. This is the recommended configuration for production deployments:

Note: In DNS mode, all applications share port 443 and are differentiated by hostname.

No-DNS Mode

In No-DNS mode, each application uses a different port. Use this when you can't configure DNS records:

Admin Console

The Admin Console is always accessible on port 30000, regardless of DNS mode:

Sensor Ports

These ports are used for sensor communication. Sensors send telemetry data to PCA and receive configuration updates:

Inter-Node Communication

These ports must be open between all cluster nodes. They're used for Kubernetes control plane communication, etcd clustering, and pod networking:

Local Process Ports

These ports are used for local communication only and don't need to be opened in firewalls between nodes:

Internal Service Ports

These are the ports used by PCA services for internal communication. You generally don't need to configure these in external firewalls, but they're useful for troubleshooting:

Firewall Rule Examples

Use these examples as templates for configuring your firewall. Adjust IP addresses and CIDRs to match your environment.

iptables (Linux)

# External access (DNS mode)
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 30000 -j ACCEPT

# Inter-node communication (replace NODE_IPS with actual IPs)
for NODE_IP in NODE_IPS; do
  iptables -A INPUT -s $NODE_IP -p tcp --dport 2380 -j ACCEPT
  iptables -A INPUT -s $NODE_IP -p udp --dport 4789 -j ACCEPT
  iptables -A INPUT -s $NODE_IP -p tcp --dport 6443 -j ACCEPT
  iptables -A INPUT -s $NODE_IP -p tcp --dport 10250 -j ACCEPT
done

firewalld (RHEL/CentOS)

# External access
firewall-cmd --permanent --add-port=443/tcp
firewall-cmd --permanent --add-port=30000/tcp

# Inter-node (create zone for cluster)
firewall-cmd --permanent --new-zone=pca-cluster
firewall-cmd --permanent --zone=pca-cluster --add-source=<node-cidr>
firewall-cmd --permanent --zone=pca-cluster --add-port=2380/tcp
firewall-cmd --permanent --zone=pca-cluster --add-port=4789/udp
firewall-cmd --permanent --zone=pca-cluster --add-port=6443/tcp
firewall-cmd --permanent --zone=pca-cluster --add-port=10250/tcp

firewall-cmd --reload

Cloud Security Groups (AWS/GCP/Azure)

Use these rules as a template for cloud security groups:

# Inbound Rules
Type        Protocol  Port    Source
HTTPS       TCP       443     0.0.0.0/0 (or restricted CIDR)
Custom TCP  TCP       30000   Admin IP range
Custom TCP  TCP       2380    Cluster security group (self)
Custom UDP  UDP       4789    Cluster security group (self)
Custom TCP  TCP       6443    Cluster security group (self)
Custom TCP  TCP       10250   Cluster security group (self)

Troubleshooting Network Issues

Use these commands when you suspect network connectivity problems.

Verify Port Connectivity

# From outside cluster
nc -zv <IP_ADDRESS> 443
nc -zv <IP_ADDRESS> 30000

# On a node to check listening ports
ss -tlnp | grep -E "(443|2443|3443|30000|6443)"

# Check inter-node connectivity
nc -zv <other-node-ip> 6443
nc -zv <other-node-ip> 2380

Common Issues

This table maps common symptoms to their likely network causes: