> For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/llms-full.txt.

# Network Ports

JumpServer is a 4A-oriented security audit platform, and its components
communicate over a defined set of ports. Open only the ports required by the
topology you deploy, and restrict the source addresses to the users, clients, and
services that need them. This page lists the ports and shows the common firewall
commands.

## Port reference

| Port  | Protocol | Purpose               | Notes                                                 |
| ----- | -------- | --------------------- | ----------------------------------------------------- |
| 22    | TCP      | SSH                   | Installation, upgrade, and host management            |
| 80    | TCP      | Web HTTP              | Browser access to the JumpServer frontend             |
| 443   | TCP      | Web HTTPS             | Browser access over TLS                               |
| 5432  | TCP      | PostgreSQL            | Built-in or external database                         |
| 3306  | TCP      | MySQL / MariaDB       | When MySQL or MariaDB is used as the database         |
| 6379  | TCP      | Redis                 | Built-in or external cache                            |
| 3389  | TCP      | Razor RDP proxy       | Windows assets accessed through the JumpServer Client |
| 3390  | TCP      | XRDP                  | Optional enterprise component, disabled by default    |
| 2222  | TCP      | SSH client            | Terminal tools such as Xshell, PuTTY, and MobaXterm   |
| 5001  | TCP      | KoKo web proxy        | Browser access to web assets                          |
| 5525  | TCP      | Magnus database proxy | The actual port is allocated per database type        |
| 15900 | TCP      | Nec VNC proxy         | VNC sessions                                          |
| 9898  | TCP      | JDMC                  | Enterprise host management service, HTTPS             |

Supporting services use their own ports: MinIO on `9000` and `9001`, Elasticsearch
on `9200` and `9300`, and HAProxy on `80`, `443`, `2222`, and `5525`. Open these
only between the hosts that need them, not to end users.

## Container network

The JumpServer containers use a bridge network, `DOCKER_SUBNET=192.168.250.0/24` by
default. Confirm that this range does not overlap with the existing network before
installation; change the `DOCKER_SUBNET` setting if it does.

## Firewall commands

The examples below use `firewalld`. Confirm that the service is running first:

```sh
firewall-cmd --state
```

Open a port permanently, then reload the rules:

```sh
firewall-cmd --zone=public --add-port=80/tcp --permanent
firewall-cmd --zone=public --add-port=443/tcp --permanent
firewall-cmd --zone=public --add-port=2222/tcp --permanent
firewall-cmd --reload
```

Remove a port with `--remove-port`:

```sh
firewall-cmd --zone=public --remove-port=80/tcp --permanent
firewall-cmd --reload
```

List the active rules with:

```sh
firewall-cmd --list-all
```


Tip

With `ufw`, open the same ports with `ufw allow <port>/tcp`. In cloud environments,
add the matching rules to the security group of the JumpServer host and of any load
balancer.

## Behind a load balancer

When a load balancer or reverse proxy sits in front of JumpServer, restrict the
backend ports to the proxy's source addresses. The proxy itself must forward
WebSocket connections, and the JumpServer `DOMAINS` setting must include the public
domain or IP users type in the browser.

## Related topics

- [Deployment Topologies](https://www.jumpserver.com/docs/operations/deployment-topologies.md)
- [Security Hardening](https://www.jumpserver.com/docs/operations/security-hardening.md)