Open the required ports
Open the firewall paths IRIS needs, so the server, the Console, your devices and your monitoring tools can reach each other. Every port is TCP, and the table lists destination ports only.
Before you start
- Pick your installation layout: one Docker host, separate Docker hosts, or Kubernetes.
- Know the server address devices use, and the Console address operators use.
- Know each device's management type.
Firewall rules
| Permit | Transport | Destination ports |
|---|---|---|
| Devices -> server | TCP | 6969, 8443, 6881; Guest Shell, IOx and IOS-XR onboarding also need 8000 |
| Operators -> Console host | TCP | 8080 |
| Explicit artifact API clients -> server, when used | TCP | 8000 |
| Prometheus or operator tooling -> server, when used | TCP | 9101 |
| Console -> server over the private management network | TCP | 9443 |
| The server container or manual installer host -> devices during onboarding | TCP | 22 |
| Devices <-> devices | TCP | 6881-6999 in both directions |
Restrict the Console port
Permit TCP 8080 from trusted operator sources only, above all before you create the first admin account. On Kubernetes, apply the same restriction to the Console LoadBalancer. Never open the agent and server control port that listens on loopback inside the container.
On one Docker host
Keep TCP 9443 on the Docker network and publish no host port for it.
On separate Docker hosts
Bind the management API to a private server address and permit TCP 9443 from the Console host only.
On Kubernetes
Services, not host firewall rules, decide what is reachable. Keep the management port on an internal Service.
IRIS uses no UDP
Every listener above is TCP. The private swarm disables DHT, peer exchange, and local peer discovery, so IRIS needs no UDP firewall rule.
Telemetry on port 9101
Open 9101 only when Prometheus or operator tooling scrapes the server.
Outbound access for telemetry export
Export over the OpenTelemetry Protocol (OTLP) needs outbound TCP from the server to your collector, commonly port 4318. See Server configuration and Export telemetry.
Verify
- From a device subnet, reach the server on TCP 6969, 8443, 6881, and 8000 if you onboard from that subnet.
- From the server, reach TCP 22 on every device you plan to onboard.
- From an operator workstation, reach TCP 8080 on the Console host.
- From the Console host, reach TCP 9443 on the server.
- Between two devices that will share pieces, pass TCP 6881-6999 both ways.
Fix any closed path before you install.