Skip to main content

Ports and listeners

Inspect 1.36

This page lists the ports a Syself Linux node opens: the process behind it, the address it binds, and which hosts can reach it. A port bound to 127.0.0.1 is reachable only from the node itself. A port bound to the node IP is reachable from the network, subject to the host firewall and any API server lockdown rules.

Control-plane node#

A control-plane node runs the Kubernetes API server and the other cluster management components.

KubeGate sits in front of the API server and controls who can reach it.

Port Bind Listener Reachable by
6443 node IP KubeGate The load balancer only. KubeGate fronts the API server on this port and forwards to it on 127.0.0.1:6443. A firewall rule (the lockdown) denies port 6443 from the public internet except the control-plane load balancer's IP. Joining nodes and management clients then authenticate with a signed token (a gate ticket) and, optionally, an allowed source IP range.
6443 127.0.0.1 kube-apiserver KubeGate only. The API server moved to loopback so KubeGate can bind the node IP. See .
9443 node IP KubeGate The load balancer only, for its readiness probe. KubeGate answers the load balancer's health check here with the local API server's real readiness (/readyz), which only passes once etcd, the informers, and the other required components are fully up. So the balancer routes to a control plane only once it can actually serve. The control-plane host-firewall rule set opens 9443, and the apiserver lockdown keeps it to the load balancer.
8180 node IP syself-tunnel-server Tunnel agents on other cluster nodes, over mTLS (mutual TLS: both sides verify each other's certificate). The firewall allows this port from cluster nodes only (remote-node / host), not the public internet. An agent needs a valid cluster certificate to connect. See .
Unix socket /etc/kubernetes/konnectivity-server/konnectivity-server.socket syself-tunnel-server The local API server sends node-bound traffic through this socket into the tunnel. No TCP port.
8181 127.0.0.1 syself-tunnel-server This node only: health check and Prometheus metrics.
10250 node IP kubelet Other cluster nodes (remote-node / host) and the metrics-server pod. The API server reaches it through the co-located tunnel agent, which the host allow covers.
2379 / 2380 node IP etcd Client / peer ports. The firewall restricts these to other cluster nodes (remote-node / host).
2381 127.0.0.1 etcd This node only: etcd /metrics and /health.
10257 127.0.0.1 kube-controller-manager This node only: metrics and healthz.
10259 127.0.0.1 kube-scheduler This node only: metrics and healthz.
8080 127.0.0.1 KubeGate This node only: Prometheus metrics. See for what they mean.
8081 127.0.0.1 KubeGate This node only: health and readiness probes.

A control-plane node also opens all ports listed under Every node below.

Worker node#

A worker node runs your application pods.

Port Bind Listener Reachable by
7443 127.0.0.1 syself-proxy The local kubelet only. The kubelet's server: URL points here once the failover proxy activates.
9587 127.0.0.1 syself-proxy This node only: Prometheus metrics.
9189 127.0.0.1 hcloud-csi-driver (CSI node plugin) This node only: Prometheus metrics. The CSI node plugin runs on the host network, so its listener is pinned to loopback. It does not run on control-plane nodes or on root (bare-metal) servers, so this port exists on cloud workers only.
10250 node IP kubelet Other cluster nodes (remote-node / host) and the metrics-server pod. The API server reaches it through the co-located tunnel agent, which the host allow covers.

Every node#

Port Bind Listener Reachable by
100 node IP sshd SSH (not the standard port 22). Key-only authentication; root login by key. You can restrict it to a source range (for example a bastion host), or turn it off entirely, with a host-firewall policy. That is a firewall change and takes effect at once, with no node rollout.
8182 127.0.0.1 syself-tunnel-agent This node only: Prometheus metrics.
10248 127.0.0.1 kubelet This node only: the kubelet healthz endpoint the health daemon probes.
1338 127.0.0.1 containerd This node only: containerd's own Prometheus metrics (gRPC, image pull, snapshotter). Per-container resource metrics come from cAdvisor on the kubelet (10250), not here.
9879 127.0.0.1 cilium-agent This node only: the agent health API.
9878 127.0.0.1 cilium-envoy This node only: the Envoy health listener.
20257 127.0.0.1 syself-agent (health daemon) This node only: node-problem-detector Prometheus metrics.
10256 127.0.0.1 cilium-agent This node only: the kube-proxy-replacement health check endpoint.
9962 127.0.0.1 cilium-agent This node only: Prometheus metrics. Cilium runs on the host network, so this is pinned to loopback rather than left on all interfaces.
9963 127.0.0.1 cilium-operator This node only, and only on nodes running the operator: Prometheus metrics.
9965 127.0.0.1 cilium-agent (Hubble) This node only: Hubble Prometheus metrics.

Cilium datapath (cluster-internal)#

Cilium handles pod-to-pod networking as the CNI (Container Network Interface) plugin. The host firewall allows these ports only from other cluster nodes (remote-node) and the local host.

Port Bind Listener Reachable by
4244 node IP cilium-agent (Hubble peer) The Hubble relay, to collect network flows from each node.
4240 node IP cilium-agent Cluster nodes: the Cilium node-to-node health check.
8472/UDP node IP Cilium (VXLAN) Cluster nodes: pod-to-pod overlay traffic (routingMode=tunnel).
51871/UDP node IP Cilium (WireGuard) Cluster nodes: node-to-node encryption when enabled. The firewall pre-allows this port, so enabling WireGuard needs no firewall rule change.

WireGuard encryption is off by default. When enabled, it covers cross-node pod traffic only. See .

Not listening (by design)#

Port What it would be Why it is off
5355 LLMNR Disabled in resolved.conf.d/10-syself.conf. A server has no use for it.
5353 mDNS Disabled in the same file.

The rule#

The host firewall is not one rule set. Control-plane nodes and worker nodes get different ones, keyed off the node-role.kubernetes.io/control-plane label, so a control-plane-only port never opens on a worker. Only two things are reachable from the public internet, and both can be locked to a source range:

  1. The kube-apiserver on control planes (6443) and its readiness probe (9443). From outside the cluster, the control-plane load balancer is the only way in: the firewall drops both ports from every other source. You can narrow that path further to a sourceCIDRs allow list.
  2. SSH on port 100 (key-only). You can restrict it to a source range, such as a bastion host, or turn it off, with a host-firewall policy.

One group is reachable from the network but firewalled to other cluster nodes only. Which ports are open depends on the node's role. Control-plane nodes open the tunnel server (8180) and etcd (2379/2380); those never open on a worker. Both roles open the kubelet (10250) and the Cilium datapath ports (4244, 4240, 8472/UDP, 51871/UDP).

Everything else is bound to 127.0.0.1 and reachable only from the node itself: the failover proxy, KubeGate's own metrics and health endpoints (8080, 8081), and all other metrics and health endpoints (2381, 10256, 10257, 10259, 8181, 8182, 9189, 9587, 20257, 9962, 9963, 9965).

There is no exception: every metrics endpoint on a node is either on loopback or, in the kubelet's case, authenticated. cilium-envoy's metrics are the one listener the upstream chart cannot bind to loopback, so they are turned off entirely rather than published on the node address. Cilium does no L7 work on these clusters: , so Envoy stays idle and its stats would be empty. Nothing is lost by turning them off.

The API server reaches kubelet and pods through the reverse tunnel, not by dialing the node directly. The tunnel agent on each node delivers that traffic to the local kubelet, which is why 10250 needs to allow only other cluster nodes and the metrics-server scrape.

Tip

You can verify the open ports on a node by running ss -tlnp from an emergency shell. See for how to get one.

Note

Probe a node from outside the cluster and you see a filtered response, not a clean rejection. The host firewall is default-deny: it silently drops any packet it does not explicitly allow, with no RST or ICMP reply. A port scan from a host that is not a cluster node and not the load balancer times out on every port except the ones listed above as public.