Remote Collector Ports

  • All nodes refer to a single remote collector.

  • The port refers to the destination node.

  • All node-to-node traffic within the cluster and all central-remote collector connectivity is encrypted.

  • See also Kubernetes networking reference.

For more information, see TOS Architecture.

Source Destination Service / Port Description

Administrator's PC

Physical IPs of all nodes

SSH <TCP 22>

Mandatory

Used for system maintenance

Physical IPs of all nodes

Physical IPs of all nodes

TCP <TCP 7472>

Required for all deployments except Azure/AWS/GCP

Used by MetalLB speaker

Physical IPs of all nodes

DNS Server

DNS <UDP 53>

Mandatory

Used for domain lookups

Physical IPs of all nodes

NTP Server

NTP <UDP 123>

Required if NTP is used for network time synchronization

Physical IPs of all nodes

Syslog Server

Syslog <UDP 514> (default) or alternative port as configured

Required if you configure notifications via syslog.

Administrator's PC

SIM/iDRAC interfaces on all Tufin Appliances

Web GUI <TCP 80> or <TCP 443> (SSL certificate upload available)

Unencrypted: KVM <TCP 7578>

CDROM <TCP 5120>

USB <TCP 5123>

Encrypted (AES/RC4/Stunnel):

KVM <TCP 7582>

CDROM <TCP 5124>

USB <TCP 5127>

Required for Tufin appliances only.

Used for Supermicro Intelligent Management (SIM) port address.

See also: Configuring SIM for Gen 4

Physical IPs of all nodes

Physical IPs of all nodes

UDP 51820

Mandatory

K3s server and agent nodes required by Wireguard

Physical IPs of all nodes

Physical IPs of all nodes

HTTPS <TCP 2379-2381>

Mandatory

Etcd server communication

Physical IPs of all nodes

Physical IPs of all nodes

HTTPS <TCP 6443-6444>

Mandatory

Kubernetes API Server

Physical IPs of all nodes

Physical IPs of all nodes

Application Specific <TCP/UDP 30000-32767>

Mandatory

Kubernetes internal service range

Physical IPs of all nodes

Physical IPs of all nodes

UDP and TCP 7946

Required for all deployments except Azure, AWS, and GCP.

Used by MetalLB speaker.

Physical IPs of all nodes

Physical IPs of all nodes

HTTPS <TCP 10248-10252,10255, 10256>

Mandatory

Kubernetes components

Physical IPs of all nodes

Physical IPs of all nodes

HTTPS <TCP 32500>

Mandatory

Docker registry

Physical IPs of all nodes

Physical IPs of all nodes

HTTPS <TCP 9100>

Mandatory

Kubernetes node-exporter

Physical IPs of all nodes

Physical IPs of all nodes

HTTPS <TCP 8080>

Required for adding and removing nodes from the cluster

Physical IPs of all nodes

Physical IPs of all nodes

TCP/UDP 2382

Mandatory

Kubernetes components

Physical IPs of all nodes

Physical IPs of all nodes

TCP 10010

Mandatory

Kubernetes components

Remote Collector cluster nodes network IPs

Central Cluster primary VIP

HTTPS <TCP 443, 8443, 61617, 8422, 9090>

For high availability, additionally: HTTPS <TCP 8423, 8424>

Required for connecting remote collector clusters

Allows central cluster to receive data from remote collector cluster

Remote Collector cluster nodes network IPs

  • External Load balancer VIP

  • Physical IPs of all nodes

HTTPS <TCP 31443, 31617, 31843,31422, 31090>

For high availability, additionally: HTTPS <TCP 31423, 31424>

Required for connecting remote collector clusters

Allows central cluster to receive data from remote collector cluster

For a Central Cluster deployed on the cloud

All Central Cluster Nodes Network IPs

Remote collector cluster Primary VIP

HTTPS <TCP 8443>

Mandatory
Required for remote collector clusters

Allows remote collector cluster to receive data from central cluster

Physical IPs of all nodes

NFS server (external storage)

NFS <TCP/UDP 2049>

rpcbind <TCP/UDP 111>

rpc.statd (listening) <TCP/UDP Dynamic, 32768–60999> (net.ipv4.ip_local_port_range)

rpc.statd (outgoing notify) <UDP Dynamic 600-1023> (privileged range)

  • Required only when NFSv3 is used, including fallback from NFSv4.

  • Both rpcbind and rpc.statd must be enabled on all nodes.

  • rpcbind is disabled by default.

  • rpc.statd ports are assigned dynamically at service start and may differ per node.

  • The listening ports (TCP/UDP) are taken from the kernel ephemeral range defined by net.ipv4.ip_local_port_range (default 32768–60999).

  • The outgoing notify port (UDP) is taken from the privileged range 600–1023. Verify the assigned ports with rpcinfo -p, or set fixed ports in /etc/nfs.conf under [statd] using port= and outgoing-port=.