Network Port Usage: Difference between revisions
Jump to navigation
Jump to search
Created page with "== QuantaStor Network Port Reference == This page lists all TCP/UDP ports used by QuantaStor and its supporting services. Ports bound only to <code>127.0.0.1</code> (loopback) are for internal inter-process communication and are not externally reachable. Firewall rules should be applied to externally bound ports based on the guidance in the rightmost column. === QuantaStor Core Services === {| class="wikitable sortable" ! Port !! Proto !! Process !! Service / Descript..." |
|||
| Line 22: | Line 22: | ||
| '''443''' || TCP || <code>nginx</code> || HTTPS — QuantaStor Web UI || Allow from admin networks | | '''443''' || TCP || <code>nginx</code> || HTTPS — QuantaStor Web UI || Allow from admin networks | ||
|- | |- | ||
| '''8080''' || TCP || <code>nginx</code> || Alternate HTTP proxy || Restrict to admin networks | | '''8080''' || TCP || <code>nginx</code> || Alternate HTTP proxy — redirects to HTTPS || Restrict to admin networks | ||
|- | |- | ||
| '''8153''' || TCP || <code>nginx</code> || QuantaStor Web UI proxy || Allow from admin networks | | '''8153''' || TCP || <code>nginx</code> || QuantaStor Web UI proxy || Allow from admin networks | ||
Revision as of 19:10, 11 May 2026
QuantaStor Network Port Reference
This page lists all TCP/UDP ports used by QuantaStor and its supporting services. Ports bound only to 127.0.0.1 (loopback) are for internal inter-process communication and are not externally reachable. Firewall rules should be applied to externally bound ports based on the guidance in the rightmost column.
QuantaStor Core Services
| Port | Proto | Process | Service / Description | Firewall Recommendation |
|---|---|---|---|---|
| 5151 | TCP | qs_service |
QuantaStor Management API (HTTP) | Allow from admin networks only |
| 5152 | TCP | qs_service |
QuantaStor Management API (HTTPS) — loopback only | Internal only (loopback) |
Web UI & Proxy (nginx)
| Port | Proto | Process | Service / Description | Firewall Recommendation |
|---|---|---|---|---|
| 80 | TCP | nginx |
HTTP — redirects to HTTPS | Allow or redirect to 443 |
| 443 | TCP | nginx |
HTTPS — QuantaStor Web UI | Allow from admin networks |
| 8080 | TCP | nginx |
Alternate HTTP proxy — redirects to HTTPS | Restrict to admin networks |
| 8153 | TCP | nginx |
QuantaStor Web UI proxy | Allow from admin networks |
| 8889 | TCP | nginx |
Grafana / metrics dashboard proxy | Restrict to admin networks |
Storage Protocols
| Port | Proto | Process | Service / Description | Firewall Recommendation |
|---|---|---|---|---|
| 2049 | TCP | kernel (nfsd) |
NFS (NFSv3 / NFSv4) | Allow from NFS client networks |
| 3260 | TCP | iscsi-scstd |
iSCSI target | Allow from iSCSI initiator networks only |
| 139 | TCP | smbd |
SMB / NetBIOS Session Service | Allow from SMB client networks |
| 445 | TCP | smbd |
SMB (Direct over TCP) | Allow from SMB client networks |
Monitoring & Telemetry
| Port | Proto | Process | Service / Description | Firewall Recommendation |
|---|---|---|---|---|
| 8888 | TCP6 | chronograf |
InfluxDB Chronograf UI | Restrict to admin networks |
| 8086 | TCP | influxd |
InfluxDB HTTP API — loopback only | Internal only (loopback) |
| 8088 | TCP | influxd |
InfluxDB RPC — loopback only | Internal only (loopback) |
System & Infrastructure
| Port | Proto | Process | Service / Description | Firewall Recommendation |
|---|---|---|---|---|
| 22 | TCP | sshd |
SSH remote access | Allow from admin networks; restrict by IP |
| 111 | TCP | rpcbind |
RPC portmapper (required for NFS/NLM) | Allow from NFS client networks |
NFS Auxiliary Ports (Dynamic by Default)
| Port | Proto | Process | Service / Description | Firewall Recommendation |
|---|---|---|---|---|
| Dynamic | TCP | rpc.statd |
NFS lock manager status (NSM) | Pin with STATD_PORT; allow from NFS clients
|
| Dynamic | TCP | rpc.mountd |
NFS mount daemon | Pin with MOUNTD_PORT; allow from NFS clients
|
Loopback-Only Internal Ports
The following ports are bound to 127.0.0.1 only and are not accessible from the network. They are listed here for completeness and troubleshooting reference.
| Port | Process | Description |
|---|---|---|
| 5152 | qs_service |
Management API HTTPS (internal) |
| 5154 | python3 |
Internal QuantaStor service |
| 5156 | python3 |
Internal QuantaStor service |
| 5173 | qs_restd |
REST daemon (internal) |
| 8086 | influxd |
InfluxDB HTTP API |
| 8088 | influxd |
InfluxDB RPC |
| 8154 | python3 |
Internal service |
| 8181 | java |
Internal Java service |
| 8005 | java |
Tomcat shutdown port |
| 2224 | python3 |
Internal QuantaStor service |
| 2628 | dictd |
Dictionary service (dictd) |
Notes & Recommendations
- NFS auxiliary ports (
rpc.statd,rpc.mountd) are assigned dynamically by default. For consistent firewall rules, pin them by settingSTATD_PORTandMOUNTD_PORTin/etc/default/nfs-kernel-server. - iSCSI (3260) should be isolated to a dedicated storage VLAN and never exposed to general-purpose networks.
- SMB (139, 445) should be allowed only from client subnets. Do not expose to the public internet.
- Grafana/Chronograf (8889, 8888) should be restricted to administrator networks as they expose internal metrics.
- SSH (22) access should be restricted by source IP using firewall rules or TCP wrappers.
- dictd (2628) is a loopback-only dictionary lookup daemon used internally; no external access required.