Step 10: Configuring the node ports

Enable firewall ports for Automation Suite cluster communication on Linux.

Note:

Changes to IP tables are not recommended or supported.

Make sure to enable the following ports on your firewall for each source.

The following ports require inbound or outbound network access between cluster nodes, external clients, or the load balancer:

Port	Protocol	Source	Purpose	Requirements
22	TCP	Jump Server / client machine	For SSH (installation, cluster management debugging)	Do not open this port to the internet. Allow access to the client machine or jump server.
443	TCP	All nodes in a cluster and the load balancer	For HTTPS (accessing Automation Suite)	This port must have inbound and outbound connectivity from all the nodes in the cluster and the load balancer.
2334	TCP	All nodes in a cluster	Transient HTTP file server (hostNetwork: true, 0.0.0.0) used by uipathctl support-bundle to collect logs and metrics. Open only during support-bundle, historical-logs, or service-metrics collection.	Do not open this port to the internet. Allow node-to-node connectivity inside the cluster CIDR.
2379	TCP	All nodes in a cluster	etcd client port	Do not open this port to the internet. Access between nodes must be ensured over a private IP address.
2380	TCP	All nodes in a cluster	etcd peer port	Do not open this port to the internet. Access between nodes must be ensured over a private IP address.
4240	TCP	Peer Cilium agent pods on other cluster nodes	Cilium cluster-wide health probe for verifying L3 reachability between nodes; binds to the node IP, not 0.0.0.0. Blocking inter-node connectivity causes false-positive node-down alerts.	Do not open this port to the internet. Allow node-to-node connectivity inside the cluster CIDR.
5001	TCP	RKE2 internal (kubelet/containerd image pull)	RKE2 embedded internal image registry (separate from offline-registry port 30070), hosting pre-loaded images pulled during cluster startup. Present only on the bootstrap server node.	Binds to 0.0.0.0:5001 on the bootstrap server; allow intra-cluster access from peer nodes. Do not open this port to the internet.
6443	TCP	All nodes in a cluster	For accessing Kube API using HTTPS, and required for node joining. On worker nodes, rke2 agent also binds 127.0.0.1:6443 as a local load-balancer for apiserver access.	This port must have inbound and outbound connectivity from all the nodes in the cluster. Do not block it on the loopback interface; worker nodes will go NotReady.
8472	UDP	All nodes in a cluster	Required for Cilium.	Do not open this port to the internet. Access between nodes must be ensured over a private IP address.
9090	TCP	All nodes in the cluster	Used by Cilium for monitoring and handling pod crashes	This port must have inbound and outbound connectivity from all the nodes in the cluster.
9100	TCP	Cluster Prometheus pods	Prometheus node_exporter (monitoring-prometheus-node-exporter DaemonSet): host-level metrics (CPU, memory, filesystem, network, process counts). Binds to 0.0.0.0:9100.	Do not open this port to the internet; exposes sensitive host telemetry. Allow intra-cluster scrape from Prometheus pods.
9345	TCP	All nodes in a cluster and the load balancer	For accessing Kube API using HTTPS, required for node joining	This port must have inbound and outbound connectivity from all nodes in the cluster and the load balancer.
9963	TCP	Cluster Prometheus pods	cilium-operator Prometheus metrics endpoint: operator-level metrics (leader-election, identity GC, CNP processing). Binds to 0.0.0.0:9963.	Do not open this port to the internet. Allow intra-cluster scrape from Prometheus pods.
10250	TCP	All nodes in a cluster	kubelet / metrics server	Do not open this port to the internet. Access between nodes must be ensured over a private IP address.
30000–32767	TCP	All nodes in a cluster	NodePort range for Istio Ingress Gateway; required for routing external traffic into the cluster via Kubernetes NodePort services	This port range must have inbound connectivity from the load balancer to all nodes in the cluster. Do not open this port range to the internet; route traffic only through the load balancer.
30071	TCP	All nodes in a cluster	NodePort port for internal communication between nodes in a cluster	Do not open this port to the internet. Access between nodes must be ensured over a private IP address.

The following ports bind to 127.0.0.1 (loopback) only and are not reachable across the network. Do not block them on the loopback interface:

Port	Protocol	Source	Purpose	Requirements
2381	TCP	Local node only (loopback)	etcd metrics endpoint used for etcd readiness probes. No cross-cluster scrape is configured by default.	Binds to 127.0.0.1 only. Do not block on the loopback interface.
2382	TCP	Local node only (loopback)	etcd loopback peer endpoint used by RKE2's internal etcd controller for member-list and cluster-management operations	Binds to 127.0.0.1 only. Do not block on the loopback interface.
6444	TCP	Local node only (loopback)	On worker nodes: RKE2 agent supervisor load-balancer; routes local agent components (kubelet, kube-proxy, helm-controller) to healthy supervisor servers on port 9345	Binds to 127.0.0.1 only. Do not block on the loopback interface; kubelet and kube-proxy will lose control plane connectivity and the node will go NotReady.
9234	TCP	Local node only (loopback)	Cilium operator REST API (/healthz); target of the cilium-operator pod liveness probe	Binds to 127.0.0.1 only. Do not block on the loopback interface; the liveness probe will fail, stopping CRD reconciliation, identity GC, and BGP routing.
9879	TCP	Local node only (loopback)	cilium-agent /healthz endpoint; target of the cilium-agent liveness, readiness, and startup probes	Binds to 127.0.0.1 only. Do not block on the loopback interface; kubelet probes will fail and cilium-agent will be restarted, causing CNI disruption cluster-wide.
10256	TCP	Local node only (loopback)	kube-proxy /livez healthz endpoint; target of the kube-proxy static-pod liveness probe	Binds to 127.0.0.1 only. Do not block on the loopback interface; the liveness probe will fail and kubelet will restart kube-proxy.
10257	TCP	Local node only (loopback)	kube-controller-manager secure-port endpoint (/healthz, /metrics, leader-election). Control-plane nodes only.	Binds to 127.0.0.1 only.
10259	TCP	Local node only (loopback)	kube-scheduler secure-port endpoint (/healthz, /metrics, leader-election). Control-plane nodes only.	Binds to 127.0.0.1 only.

The following additional ports are required in offline installations:

Port	Protocol	Source	Purpose	Requirements
80	TCP	All nodes in the cluster	Required for sending system email notifications	Do not open this port to the internet. Access between nodes and the SMTP server must be ensured over a private IP address.
587	TCP	All nodes in the cluster	Required for sending system email notifications	Do not open this port to the internet. Access between nodes and the SMTP server must be ensured over a private IP address.
300701	TCP	The machine on which you plan to trigger the installation or upgrade.	For accessing the temporary registry during installation and upgrade using HTTP.	Traffic on this port must be forwarded to the Temporary Registry Pool.

¹ If an external registry is not available in the offline installation, open port 30070 on the machine on which you plan to trigger the installation or upgrade.

Important:

Exposing port 6443 outside the cluster boundary is mandatory if there is a direct connection to the Kerberos API.

Port 9345 is used by nodes to discover existing nodes and join the cluster in the multi-node deployment. To keep the high availability discovery mechanisms running, we recommend exposing it via the load balancer with health check.

Additionally, make sure you have connectivity from all nodes to the SQL server. Do not expose the SQL server on one of the Istio reserved ports, as it may lead to connection failures.

If you have a firewall set up in the network, make sure that it has these ports open and allows traffic according to the aforementioned requirements.