For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/llms-full.txt, and this page is available as Markdown at https://www.jumpserver.com/docs/operations/network-ports.md.
🎉 JumpServer v5.1.1 is available. See what's new →
  • v5

    • Network Ports

    JumpServer is a 4A-oriented security audit platform, and its components communicate over a defined set of ports. Open only the ports required by the topology you deploy, and restrict the source addresses to the users, clients, and services that need them. This page lists the ports and shows the common firewall commands.

    Port reference

    PortProtocolPurposeNotes
    22TCPSSHInstallation, upgrade, and host management
    80TCPWeb HTTPBrowser access to the JumpServer frontend
    443TCPWeb HTTPSBrowser access over TLS
    5432TCPPostgreSQLBuilt-in or external database
    3306TCPMySQL / MariaDBWhen MySQL or MariaDB is used as the database
    6379TCPRedisBuilt-in or external cache
    3389TCPRazor RDP proxyWindows assets accessed through the JumpServer Client
    3390TCPXRDPOptional enterprise component, disabled by default
    2222TCPSSH clientTerminal tools such as Xshell, PuTTY, and MobaXterm
    5001TCPKoKo web proxyBrowser access to web assets
    5525TCPMagnus database proxyThe actual port is allocated per database type
    15900TCPNec VNC proxyVNC sessions
    9898TCPJDMCEnterprise host management service, HTTPS

    Supporting services use their own ports: MinIO on 9000 and 9001, Elasticsearch on 9200 and 9300, and HAProxy on 80, 443, 2222, and 5525. Open these only between the hosts that need them, not to end users.

    Container network

    The JumpServer containers use a bridge network, DOCKER_SUBNET=192.168.250.0/24 by default. Confirm that this range does not overlap with the existing network before installation; change the DOCKER_SUBNET setting if it does.

    Firewall commands

    The examples below use firewalld. Confirm that the service is running first:

    firewall-cmd --state

    Open a port permanently, then reload the rules:

    firewall-cmd --zone=public --add-port=80/tcp --permanent
firewall-cmd --zone=public --add-port=443/tcp --permanent
firewall-cmd --zone=public --add-port=2222/tcp --permanent
firewall-cmd --reload

    Remove a port with --remove-port:

    firewall-cmd --zone=public --remove-port=80/tcp --permanent
firewall-cmd --reload

    List the active rules with:

    firewall-cmd --list-all
    Tip

    With ufw, open the same ports with ufw allow <port>/tcp. In cloud environments, add the matching rules to the security group of the JumpServer host and of any load balancer.

    Behind a load balancer

    When a load balancer or reverse proxy sits in front of JumpServer, restrict the backend ports to the proxy's source addresses. The proxy itself must forward WebSocket connections, and the JumpServer DOMAINS setting must include the public domain or IP users type in the browser.