Ports and listeners
This page lists the ports a Syself Linux node opens: the process behind it, the address it binds, and which hosts can reach it. A port bound to 127.0.0.1 is reachable only from the node itself. A port bound to the node IP is reachable from the network, subject to the host firewall and any API server lockdown rules.
Control-plane node#
A control-plane node runs the Kubernetes API server and the other cluster management components.
KubeGate sits in front of the API server and controls who can reach it.
| Port | Bind | Listener | Reachable by |
|---|---|---|---|
6443 | node IP | KubeGate | The load balancer only. KubeGate fronts the API server on this port and forwards to it on 127.0.0.1:6443. A firewall rule (the lockdown) denies port 6443 from the public internet except the control-plane load balancer's IP. Joining nodes and management clients then authenticate with a signed token (a gate ticket) and, optionally, an allowed source IP range. |
6443 | 127.0.0.1 | kube-apiserver | KubeGate only. The API server moved to loopback so KubeGate can bind the node IP. See Platform components . |
9443 | node IP | KubeGate | The load balancer only, for its readiness probe. KubeGate answers the load balancer's health check here with the local API server's real readiness (/readyz), which only passes once etcd, the informers, and the other required components are fully up. So the balancer routes to a control plane only once it can actually serve. The control-plane host-firewall rule set opens 9443, and the apiserver lockdown keeps it to the load balancer. |
8180 | node IP | syself-tunnel-server | Tunnel agents on other cluster nodes, over mTLS (mutual TLS: both sides verify each other's certificate). The firewall allows this port from cluster nodes only (remote-node / host), not the public internet. An agent needs a valid cluster certificate to connect. See Networking . |
| Unix socket | /etc/kubernetes/konnectivity-server/konnectivity-server.socket | syself-tunnel-server | The local API server sends node-bound traffic through this socket into the tunnel. No TCP port. |
8181 | 127.0.0.1 | syself-tunnel-server | This node only: health check and Prometheus metrics. |
10250 | node IP | kubelet | Other cluster nodes (remote-node / host) and the metrics-server pod. The API server reaches it through the co-located tunnel agent, which the host allow covers. |
2379 / 2380 | node IP | etcd | Client / peer ports. The firewall restricts these to other cluster nodes (remote-node / host). |
2381 | 127.0.0.1 | etcd | This node only: etcd /metrics and /health. |
10257 | 127.0.0.1 | kube-controller-manager | This node only: metrics and healthz. |
10259 | 127.0.0.1 | kube-scheduler | This node only: metrics and healthz. |
8080 | 127.0.0.1 | KubeGate | This node only: Prometheus metrics. See Restrict API server access for what they mean. |
8081 | 127.0.0.1 | KubeGate | This node only: health and readiness probes. |
A control-plane node also opens all ports listed under Every node below.
Worker node#
A worker node runs your application pods.
| Port | Bind | Listener | Reachable by |
|---|---|---|---|
7443 | 127.0.0.1 | syself-proxy | The local kubelet only. The kubelet's server: URL points here once the failover proxy activates. |
9587 | 127.0.0.1 | syself-proxy | This node only: Prometheus metrics. |
9189 | 127.0.0.1 | hcloud-csi-driver (CSI node plugin) | This node only: Prometheus metrics. The CSI node plugin runs on the host network, so its listener is pinned to loopback. It does not run on control-plane nodes or on root (bare-metal) servers, so this port exists on cloud workers only. |
10250 | node IP | kubelet | Other cluster nodes (remote-node / host) and the metrics-server pod. The API server reaches it through the co-located tunnel agent, which the host allow covers. |
Every node#
| Port | Bind | Listener | Reachable by |
|---|---|---|---|
100 | node IP | sshd | SSH (not the standard port 22). Key-only authentication; root login by key. You can restrict it to a source range (for example a bastion host), or turn it off entirely, with a host-firewall policy. That is a firewall change and takes effect at once, with no node rollout. |
8182 | 127.0.0.1 | syself-tunnel-agent | This node only: Prometheus metrics. |
10248 | 127.0.0.1 | kubelet | This node only: the kubelet healthz endpoint the health daemon probes. |
1338 | 127.0.0.1 | containerd | This node only: containerd's own Prometheus metrics (gRPC, image pull, snapshotter). Per-container resource metrics come from cAdvisor on the kubelet (10250), not here. |
9879 | 127.0.0.1 | cilium-agent | This node only: the agent health API. |
9878 | 127.0.0.1 | cilium-envoy | This node only: the Envoy health listener. |
20257 | 127.0.0.1 | syself-agent (health daemon) | This node only: node-problem-detector Prometheus metrics. |
10256 | 127.0.0.1 | cilium-agent | This node only: the kube-proxy-replacement health check endpoint. |
9962 | 127.0.0.1 | cilium-agent | This node only: Prometheus metrics. Cilium runs on the host network, so this is pinned to loopback rather than left on all interfaces. |
9963 | 127.0.0.1 | cilium-operator | This node only, and only on nodes running the operator: Prometheus metrics. |
9965 | 127.0.0.1 | cilium-agent (Hubble) | This node only: Hubble Prometheus metrics. |
Cilium datapath (cluster-internal)#
Cilium handles pod-to-pod networking as the CNI (Container Network Interface) plugin. The host firewall allows these ports only from other cluster nodes (remote-node) and the local host.
| Port | Bind | Listener | Reachable by |
|---|---|---|---|
4244 | node IP | cilium-agent (Hubble peer) | The Hubble relay, to collect network flows from each node. |
4240 | node IP | cilium-agent | Cluster nodes: the Cilium node-to-node health check. |
8472/UDP | node IP | Cilium (VXLAN) | Cluster nodes: pod-to-pod overlay traffic (routingMode=tunnel). |
51871/UDP | node IP | Cilium (WireGuard) | Cluster nodes: node-to-node encryption when enabled. The firewall pre-allows this port, so enabling WireGuard needs no firewall rule change. |
WireGuard encryption is off by default. When enabled, it covers cross-node pod traffic only. See Encrypt pod traffic with WireGuard .
Not listening (by design)#
| Port | What it would be | Why it is off |
|---|---|---|
5355 | LLMNR | Disabled in resolved.conf.d/10-syself.conf. A server has no use for it. |
5353 | mDNS | Disabled in the same file. |
The rule#
The host firewall is not one rule set. Control-plane nodes and worker nodes get different ones, keyed off the node-role.kubernetes.io/control-plane label, so a control-plane-only port never opens on a worker. Only two things are reachable from the public internet, and both can be locked to a source range:
- The kube-apiserver on control planes (
6443) and its readiness probe (9443). From outside the cluster, the control-plane load balancer is the only way in: the firewall drops both ports from every other source. You can narrow that path further to asourceCIDRsallow list. - SSH on port
100(key-only). You can restrict it to a source range, such as a bastion host, or turn it off, with a host-firewall policy.
One group is reachable from the network but firewalled to other cluster nodes only. Which ports are open depends on the node's role. Control-plane nodes open the tunnel server (8180) and etcd (2379/2380); those never open on a worker. Both roles open the kubelet (10250) and the Cilium datapath ports (4244, 4240, 8472/UDP, 51871/UDP).
Everything else is bound to 127.0.0.1 and reachable only from the node itself: the failover proxy, KubeGate's own metrics and health endpoints (8080, 8081), and all other metrics and health endpoints (2381, 10256, 10257, 10259, 8181, 8182, 9189, 9587, 20257, 9962, 9963, 9965).
There is no exception: every metrics endpoint on a node is either on loopback or, in the kubelet's case, authenticated. cilium-envoy's metrics are the one listener the upstream chart cannot bind to loopback, so they are turned off entirely rather than published on the node address. Cilium does no L7 work on these clusters: L7 and DNS network policies are blocked , so Envoy stays idle and its stats would be empty. Nothing is lost by turning them off.
The API server reaches kubelet and pods through the reverse tunnel, not by dialing the node directly. The tunnel agent on each node delivers that traffic to the local kubelet, which is why 10250 needs to allow only other cluster nodes and the metrics-server scrape.
Tip
You can verify the open ports on a node by running ss -tlnp from an emergency shell. See Emergency node access for how to get one.
Note
Probe a node from outside the cluster and you see a filtered response, not a clean rejection. The host firewall is default-deny: it silently drops any packet it does not explicitly allow, with no RST or ICMP reply. A port scan from a host that is not a cluster node and not the load balancer times out on every port except the ones listed above as public.
Related#
- Networking : how Cilium, the tunnel, and the host firewall fit together.
- Zero trust on public networks : why nodes on the public internet are safe.
- Node and OS security : the host firewall and SSH configuration.
- Encrypt pod traffic with WireGuard : enabling port
51871/UDP. - Node labels and annotations : labels Syself sets at node provisioning time.
Node labels and annotations
All labels and annotations on a Syself Autopilot node, who sets each one, and what reads it. Covers role, topology, hardware, bootstrap, and health annotation.
Node health conditions
All NodeConditions the health daemon can set on a Syself Autopilot node, what triggers each, their disposition, and which conditions cause automatic machine replacement.