Network Port Usage Reference Guide
This page lists all TCP/UDP ports used by QuantaStor and its supporting services. Ports bound only to 127.0.0.1 (loopback) are for internal inter-process communication and are not externally reachable. Firewall rules should be applied to externally bound ports based on the guidance in the rightmost column.
QuantaStor Core Services
| Port |
Proto |
Process |
Service / Description |
Firewall Recommendation
|
| 5151 |
TCP |
qs_service |
QuantaStor Management API (HTTP) |
Allow from admin networks only
|
Web UI & Proxy (nginx)
| Port |
Proto |
Process |
Service / Description |
Firewall Recommendation
|
| 80 |
TCP |
nginx |
HTTP -> redirects to HTTPS |
Allow or redirect to 443
|
| 443 |
TCP |
nginx |
HTTPS - QuantaStor Web UI |
Allow from admin networks
|
| 8080 |
TCP |
nginx |
Alternate HTTP proxy -> redirects to HTTPS |
Allow from admin networks
|
| 8153 |
TCP |
nginx |
QuantaStor Web UI proxy |
Allow from admin networks
|
| 8889 |
TCP |
nginx |
Grafana / metrics dashboard proxy |
Restrict to admin networks
|
Storage Protocols
| Port |
Proto |
Process |
Service / Description |
Firewall Recommendation
|
| 2049 |
TCP |
kernel (nfsd) |
NFS (NFSv3 / NFSv4) |
Allow from NFS client networks
|
| 3260 |
TCP |
iscsi-scstd |
iSCSI target |
Allow from iSCSI initiator networks only
|
| 139 |
TCP |
smbd |
SMB / NetBIOS Session Service |
Allow from SMB client networks
|
| 445 |
TCP |
smbd |
SMB (Direct over TCP) |
Allow from SMB client networks
|
Monitoring & Telemetry
| Port |
Proto |
Process |
Service / Description |
Firewall Recommendation
|
| 8888 |
TCP6 |
chronograf |
InfluxDB Chronograf UI |
Restrict to admin networks
|
System & Infrastructure
| Port |
Proto |
Process |
Service / Description |
Firewall Recommendation
|
| 22 |
TCP |
sshd |
SSH remote access |
Allow from admin networks; restrict by IP
|
| 111 |
TCP |
rpcbind |
RPC portmapper (required for NFS/NLM) |
Allow from NFS client networks
|
NFS Auxiliary Ports (Dynamic by Default)
| Port |
Proto |
Process |
Service / Description |
Firewall Recommendation
|
| Dynamic |
TCP |
rpc.statd |
NFS lock manager status (NSM) |
Pin with STATD_PORT; allow from NFS clients
|
| Dynamic |
TCP |
rpc.mountd |
NFS mount daemon |
Pin with MOUNTD_PORT; allow from NFS clients
|
Loopback-Only Internal Ports
The following ports are bound to 127.0.0.1 only and are not accessible from the network. They are listed here for completeness and troubleshooting reference.
| Port |
Process |
Description
|
| 5152 |
qs_service |
Management API HTTPS (internal)
|
| 5154 |
python3 |
Internal QuantaStor service
|
| 5156 |
python3 |
Internal QuantaStor service
|
| 5173 |
qs_restd |
REST daemon (internal)
|
| 8086 |
influxd |
InfluxDB HTTP API
|
| 8088 |
influxd |
InfluxDB RPC
|
| 8154 |
python3 |
Internal service
|
| 8181 |
java |
Internal Java service
|
| 8005 |
java |
Tomcat shutdown port
|
| 2224 |
python3 |
Internal QuantaStor service
|
| 2628 |
dictd |
Dictionary service (dictd)
|
Notes & Recommendations
- NFS auxiliary ports (
rpc.statd, rpc.mountd) are assigned dynamically by default. For consistent firewall rules, pin them by setting STATD_PORT and MOUNTD_PORT in /etc/default/nfs-kernel-server.
- iSCSI (3260) should be isolated to a dedicated storage VLAN and never exposed to general-purpose networks.
- SMB (139, 445) should be allowed only from client subnets. Do not expose to the public internet.
- Grafana/Chronograf (8889, 8888) should be restricted to administrator networks as they expose internal metrics.
- SSH (22) access should be restricted by source IP using firewall rules or TCP wrappers.
- dictd (2628) is a loopback-only dictionary lookup daemon used internally; no external access required.