|
1 | 1 | --- |
2 | | -title: Network, ports, and firewall for {{site.base_gateway}} |
| 2 | +title: "{{site.base_gateway}} ports" |
3 | 3 | content_type: reference |
4 | 4 | layout: reference |
5 | 5 |
|
6 | 6 | products: |
7 | 7 | - gateway |
8 | 8 |
|
9 | | -description: placeholder |
| 9 | +min_version: |
| 10 | + gateway: '3.4' |
| 11 | + |
| 12 | +description: Learn which ports {{site.base_gateway}} uses and how to configure them. |
10 | 13 |
|
11 | 14 | related_resources: |
12 | 15 | - text: "Secure {{site.base_gateway}}" |
13 | 16 | url: /gateway/security/ |
| 17 | + - text: Proxying with {{site.base_gateway}} |
| 18 | + url: /gateway/traffic-control/proxying/ |
| 19 | + - text: "{{site.base_gateway}} networking" |
| 20 | + url: /gateway/network/ |
14 | 21 | --- |
15 | 22 |
|
16 | | -@todo |
| 23 | +{{site.base_gateway}} needs port access for two main types of connections: traffic passing through the proxy and managing the {{site.base_gateway}} via the Admin API. |
| 24 | + |
| 25 | +## Proxy ports |
| 26 | + |
| 27 | +In general, the proxy ports are the *only* ports that should be made available to your clients. Upstream services are accessible via the proxy interface and ports, so make sure that these values only grant the access level you require. |
| 28 | + |
| 29 | +Your proxy will need have rules added for any HTTP/HTTPS and TCP/TLS stream listeners that you configure. For example, if you want {{site.base_gateway}} to manage traffic on port `4242`, your firewall must allow traffic on that port. |
| 30 | + |
| 31 | +The following are the default proxy ports: |
| 32 | + |
| 33 | +| Port | Protocol | `kong.conf` setting | Description | |
| 34 | +|---------|---------|------------|------------| |
| 35 | +| `8000` | HTTP | [`proxy_listen`](/gateway/configuration/#proxy_listen) | Takes incoming HTTP traffic from [Consumers](/gateway/entities/consumer/), and forwards it to upstream services. | |
| 36 | +| `8443` | HTTPS | [`proxy_listen`](/gateway/configuration/#proxy_listen) | Takes incoming HTTPS traffic from [Consumers](/gateway/entities/consumer/), and forwards it to upstream services. | |
| 37 | + |
| 38 | +You can also proxy TCP/TLS streams, which is disabled by default. If you want to proxy this traffic, see [`stream_listen` in the Kong configuration reference](/gateway/configuration/) for more information about stream proxy listen options and how to enable it. |
| 39 | + |
| 40 | +## Admin API ports |
| 41 | + |
| 42 | +The Admin API is used to manage {{site.base_gateway}}. You should [prevent unauthorized access](/gateway/secure-the-admin-api/) to these ports in production. |
| 43 | + |
| 44 | +The following are the default ports used by the Admin API: |
| 45 | + |
| 46 | +| Port | Protocol | `kong.conf` setting | Description | |
| 47 | +|---------|---------|------------|------------| |
| 48 | +| `8001` | HTTP | [`admin_listen`](/gateway/configuration/#admin_listen) | Listens for Admin API calls from the command line over HTTP. | |
| 49 | +| `8444` | HTTPS | [`admin_listen`](/gateway/configuration/#admin_listen) | Listens for Admin API calls from the command line over HTTPS. | |
| 50 | + |
| 51 | +## Other default ports |
| 52 | + |
| 53 | +In addition to the proxy and Admin API ports, {{site.base_gateway}} listens on the following other ports by default: |
| 54 | + |
| 55 | +| Port | Protocol | `kong.conf` setting | Description | |
| 56 | +|---------|---------|------------|------------| |
| 57 | +| `8002` | HTTP | [`admin_gui_listen`](/gateway/configuration/#admin_gui_listen) | Kong Manager (GUI). Listens for HTTP traffic. | |
| 58 | +| `8445` | HTTPS | [`admin_gui_listen`](/gateway/configuration/#admin_gui_listen) | Kong Manager (GUI). Listens for HTTPS traffic. | |
| 59 | +| `8005` | TCP | [`cluster_listen`](/gateway/configuration/#cluster_listen) | Hybrid mode only. Control plane listens for traffic from data plane nodes. | |
| 60 | +| `8006` | TCP | [`cluster_telemetry_listen`](/gateway/configuration/#cluster_telemetry_listen) | Hybrid mode only. Control plane listens for Vitals telemetry data from data plane nodes. | |
| 61 | +| `8007` | HTTP | [`status_listen`](/gateway/configuration/#status_listen) | Status listener. Listens for calls from monitoring clients over HTTP. | |
17 | 62 |
|
18 | | -I don't know if reference is the correct format. Maybe a landing page with separate reference pages? |
| 63 | +<!-- port 8007 in the table needs to be marked as if_version gte:3.6.x --> |
19 | 64 |
|
20 | | -Possible content: |
21 | | -* https://docs.konghq.com/gateway/3.9.x/production/networking/firewall/ |
22 | | -* https://docs.konghq.com/gateway/3.9.x/production/networking/dns-considerations/ |
23 | | -* https://docs.konghq.com/gateway/3.9.x/production/networking/cp-dp-proxy/ |
24 | | -* https://docs.konghq.com/konnect/network/ |
25 | | -* https://docs.konghq.com/gateway/latest/production/networking/default-ports/ |
|
0 commit comments