Assets Server network ports – Help Center

This article describes the network ports that can be used by Assets Server.

Important: A cluster of Assets Server nodes requires port 5701 and 9300 to be opened to support proper cluster communication. This cluster of nodes should be considered private and should run behind a firewall or load balancer in which you typically only open port 80 or 443 (for communication with Assets Server using https). All users of the cluster (both internal and external) should connect through the firewall or load balancer.

Note that Hazelcast and Elasticsearch are not secured, meaning that opening up port 9100, 9200, 9300 or 5701 (towards the Internet or internal network) is a security risk.

Be sure therefore to properly protect your machine or cluster before installing Assets Server.

HTTP serverPort: 80

HTTPS serverPort: 443

Hazelcast: 5701

Elasticsearch: 9200, 9300

Assets Server Health API: 9100

Notes:

It is assumed that the ICMP protocol is open so that the nodes can ping each other.
For all ports mentioned above, TCP should be specified as the protocol.
Hazelcast is used for the communication between the nodes in the Assets Server cluster.
Elasticsearch is the search engine that takes care of searching and indexing in Assets Server
Port 9300 and 5701 need to be available for communication between all Assets Server nodes, but these ports should NOT be open to the world.
Port 443 or 80 is the only port that needs to be available for clients to connect (single node) or for the load balancer (multi-node).
Port 9100 and 9200 are only for administrative use. These should be accessed securely, for example by restricting access or by using an SSH tunnel: ssh -L 9200:localhost:9200 -N <nodeIP>

Internal ports

The following ports are used internally must not be accessible from the internet:

Port	Service	Access
8080	Assets Server HTTP	Internal / via reverse proxy only
8081	Processing cluster communication	Internal only
9100	Health API	Internal only
9200	Elasticsearch HTTP API	Localhost only
9300	Elasticsearch transport	Internal cluster only
5701	Hazelcast cluster communication	Internal cluster only

Safely accessing ports by using an ssh tunnel

To safely access ports 80, 9100 or 9200 by using an ssh tunnel, run the following command.

For example to create an SSH tunnel to an AWS EC2 machine running Assets Server:

ssh -L 9200:localhost:9200 -N ec2-user@10.20.50.190

Internal ports

Safely accessing ports by using an ssh tunnel

Related articles