Firewall Requirements
This page lists the network ports that must be open for Secfense Broker to operate correctly. The required set depends on the number of nodes deployed and whether VRRP is used for high availability.
Single Node
The following ports must be accessible on each Secfense Broker node:
| Port | Protocol | Direction | Purpose |
|---|---|---|---|
| 22 | TCP | Inbound | SSH access — management only |
| 80 | TCP | Inbound | HTTP proxy traffic |
| 443 | TCP | Inbound | HTTPS proxy traffic |
| 8002 | TCP | Inbound | Admin web interface — management only |
| 14646 | TCP | Inbound | Debug interface — management only |
Note: Ports marked as management only (22, 8002, 14646) should be restricted at the firewall level to authorized management networks or hosts. They do not need to be exposed to end users.
Two-Node Cluster
When two Secfense Broker nodes are deployed in a cluster, the following additional ports must be open between the nodes (both directions):
| Port | Protocol | Purpose |
|---|---|---|
| 22 | TCP | Cluster replication (SSH-based) |
| 6379 | TCP | Database replication |
The ports listed in the Single Node section above still apply to each node individually.
VRRP (High Availability)
If the deployment uses VRRP for virtual IP failover and state replication, the following must additionally be permitted between the nodes:
| Protocol | Purpose |
|---|---|
| VRRP (IP protocol 112) | State replication between nodes |
Note: VRRP is an IP-level protocol, not TCP or UDP. Firewall rules must permit IP protocol number 112, not a TCP/UDP port. Make sure your firewall supports protocol-based rules in addition to port-based ones.
Custom Proxy Ports
Secfense Broker can be configured to proxy traffic on ports other than the default 80 and 443. If any application representations in your deployment use non-standard ports, those ports must be opened manually in your firewall rules in addition to the defaults listed above.
Check your application representation settings in the Broker admin interface to identify any custom inbound ports that may be in use.
Summary
The table below provides a consolidated view of all scenarios:
| Port / Protocol | Scenario | Notes |
|---|---|---|
| 22/TCP | All deployments | SSH — restrict to management hosts |
| 80/TCP | All deployments | HTTP proxy |
| 443/TCP | All deployments | HTTPS proxy |
| 8002/TCP | All deployments | Admin interface — restrict to management hosts |
| 14646/TCP | All deployments | Debug interface — restrict to management hosts |
| 22/TCP (inter-node) | Two-node cluster | Cluster replication |
| 6379/TCP (inter-node) | Two-node cluster | DB replication |
| VRRP / proto 112 (inter-node) | HA with VRRP | State replication |
| Custom ports | If configured | Open manually per application representation |