Hi, when configuring a DMS based upon Configuring the IP network ports | DataMiner Docs, I noticed that I'm still unsure about whether the ports relate to inbound/outbound or both. Some ports are obvious while other are not.
The context of this questions is that we are looking at a DMA which is part of a cluster of other DMAs. It also has a failover pair. Cassandra Cluster and Linux are on an external Linux VM.
And the ports requirements I would like to clarify correctness on are the following (NOTE: I have left some other ports out of the list below as I'm already clear about those: e.g.: 9200, 9300, 9042, 7000, 161, 162, etc)
TCP 8004 - Both inbound (operator Cube clients) and outbound (inter-DMA communication)
NATS 4222 - Both inbound (inter-DMA communication) and outbound (inter-DMA communication)
NATS 6222 - Both inbound (inter-DMA communication) and outbound (inter-DMA communication)
NATS 8222 - Both inbound (inter-DMA communication) and outbound (inter-DMA communication)
NAS 9090 - Both inbound (inter-DMA communication) and outbound (inter-DMA communication)
TCP 80 - Inbound only (HTTP: WebAPI, WebApps, Cube). No outbound.
TCP 443 - Default secure port equivalent of port 80
TCP 5100 - No inbound. Outbound only (dataminer.services cloud connection)
Please advise.
Hi Bing,
All the ports mentioned in the documentation are for inbound traffic only. Outbound traffic usually makes use of a random port.
Port 8004 only needs inbound if the DMAs are using .NET remoting. If they are configured to use gRPC, this port can be closed.
Ports 4222, 6222, 9090 also only need inbound.
Port 8222 doesn't need to be opened. This port exposes debug information for NATS.
For port 80 and 443 it's a bit more complex. They can either be open or closed (inbound only) depending on the configuration.
Port 5100 only needs to be open for inbound if the DMS is cloud connected and only on the DMAs that are providing the cloud connection.
There is more information about port configuration available in the hardening guide, but I would highly recommend to just run the 'Security Advisory BPA'. This bpa will check the system and recommend which ports to open/close to be secure, based on the configuration of the DMA.
Thanks Seppe for the advice.