Which network ports does DESK Server use?
Both standalone DESK Servers and DESK Managed clusters require several network ports to operate, serve pages, and accept monitoring data.
Be sure to configure your network and firewall so that these ports are accessible. Note that ports should be opened for bi-directional communication.
Ports 443 (and 8443 for Managed versions earlier than 1.166) must remain open to allow incoming traffic from your data center.
| Port | Used by | Notes |
|---|---|---|
443 |
DESK Managed UI, OneAgent and REST API | Routed to local port 8022 using an iptables' prerouting rule. This port must remain open. All DESK communication to DESK Server (including OneAgent traffic since version 1.166) is handled over secure socket HTTPS communication (port 443) with strong cryptography to guarantee your data privacy. |
8443 1 |
Monitoring data from DESK OneAgent | DESK OneAgent only sends data outbound to DESK Server—it doesn't open a listening port. Each monitored machine with DESK OneAgent installed on it must access this port. This port must remain open. |
8018 |
Nodekeeper | This port can be closed to traffic coming from outside the DESK cluster. If you're running a DESK Managed cluster, only your cluster nodes need access to this port. |
8019 |
Upgrade UI | This port can be closed to traffic coming from outside the DESK cluster. If you're running a DESK Managed cluster, only your cluster nodes need access to this port. |
8020, 8021 |
DESK Managed UI and REST API | These ports can be closed to traffic coming from outside the DESK cluster. If you're running a DESK Managed cluster, only your cluster nodes need access to these ports. |
8022 |
DESK Managed UI and REST API (NGINX) | Port 8022 can be closed to traffic coming from outside the DESK cluster. This port can be used as an equivalent to 443 if usage of a non-privileged port is required. |
5701-5711 |
DESK cluster analytics engine | These ports can be closed to traffic coming from outside the DESK cluster. If you're running a DESK Managed cluster, only your cluster nodes need access to these ports. |
9042, 7000, 7001, 7199 |
Cassandra-based Hypercube storage | These ports can be closed to traffic coming from outside the DESK cluster. If you're running a DESK Managed cluster, only your cluster nodes need access to these ports. |
9200, 9300 |
Elasticsearch-based search engine | These ports can be closed to traffic coming from outside the DESK cluster. If you're running a DESK Managed cluster, only your cluster nodes need access to these ports. |
Outbound communication to DESK Mission Control
Within multi-node clusters, each node must be able to communicate with Mission Control for basic health checks (for example, component states, disk, and CPU usage), in addition to the mandatory management connection (URL: https://mcsvc.desk.com2 and IP addresses: 52.5.224.56, 52.200.165.10, 52.221.165.63, and 13.228.109.33) via HTTPS (port 443) for license validation, health monitoring, and automatic updates. Communication between DESK Managed clusters and Mission Control is based on TLS v1.2.
Communication between DESK Managed clusters and Mission Control can also be routed via a proxy, but the proxy must allow web sockets and, if the proxy is clustered, it must provide sticky sessions for web socket communication. Also, the proxy must support the SNI TLS extension.
1 DESK environments with a cluster version earlier than 1.166 use port 8443. New DESK environments still use port 8443, but this port doesn't need to be exposed to the outside of the cluster nodes. Upgraded DESK environments preserve port settings from the previous version. As a result, it is possible to have an upgraded DESK environment that still uses port 8443.
2 DESK environments older than DESK cluster version 1.138 used the domain https://opcsvc.ruxit.com/. If mcsvc.desk.com can't be reached (for example, if a proxy blocks it), then https://opcsvc.ruxit.com/ is used as a fallback.