Chapter 3. Network ports for Red Hat Edge Manager
Plan firewall rules so that administrators, automation, and edge devices can reach Red Hat Edge Manager services. The ports are the same on Red Hat OpenShift Container Platform and Red Hat Enterprise Linux; only the exposure method differs.
The Red Hat Edge Manager API server exposes a user-facing HTTPS API and a separate agent-facing mTLS API, as described in Red Hat Edge Manager API server. On standalone Red Hat Enterprise Linux deployments, an nginx flightctl-gateway service is the primary public entry point on port 443; see HTTPS gateway for standalone Red Hat Enterprise Linux deployments.
The following tables list TCP ports that appear when Red Hat Edge Manager components accept connections. On Red Hat OpenShift Container Platform, you usually reach these ports through cluster networking, Services, and Routes. On Red Hat Enterprise Linux, administrators and devices reach the gateway and passthrough ports on the host (or on the host’s DNS name). Your organization might use different host names, TLS termination, or port mappings; confirm the values that apply to your deployment before you change firewall policy.
3.1. Red Hat OpenShift Container Platform compared with Red Hat Enterprise Linux
- On Red Hat OpenShift Container Platform: Which ports are reachable from outside the cluster depends on your Routes, Ingress configuration, and load balancers, and on whether you integrate Red Hat Edge Manager with other consoles. Optional integration ports in the second inbound table are often reachable only inside the cluster unless you expose them through a Service or Route. Red Hat OpenShift Container Platform and cluster infrastructure can require many additional ports (for example, for the Kubernetes API, ingress controllers, or monitoring). Plan those rules according to Red Hat OpenShift Container Platform documentation and your platform team. The tables below list only Red Hat Edge Manager-related ports that customers often ask about for edge and administrative access.
-
On Red Hat Enterprise Linux: Use the same port numbers when you allow traffic to the DNS name or IP address of your Red Hat Edge Manager host. Configure the host firewall (for example,
firewalld), any network firewalls in front of the host, and routing so that administrators, automation, and edge devices can reach those ports. Reserve the listed port numbers on the host so they do not conflict with your monitoring, security, backup, or other local services. Plan host-hardening and firewall guidance according to Red Hat Enterprise Linux documentation and your security team.
3.2. Inbound connections
Traffic in the following tables flows toward Red Hat Edge Manager components or the endpoints that front them. The "Required or optional" column indicates whether each port serves core functionality or optional integrations.
The first table lists ports that most deployments open for the web console, user API, and enrolled devices. The second table lists optional integration ports for monitoring, image builds, telemetry, and similar features. Include those rows in firewall and host port planning when traffic crosses a network boundary.
| Port | Protocol | Service or component | Purpose | Required or optional | Counterpart |
|---|---|---|---|---|---|
| 443 | TCP | HTTPS gateway (standalone) | TLS termination and path-based routing to the web console, user API, CLI artifacts, authentication integration, image builder API, and related services on standalone Red Hat Enterprise Linux deployments | Required when administrators, users, or automation access standalone Red Hat Edge Manager through the unified gateway |
Browsers, the Red Hat Edge Manager CLI, REST clients, and CI/CD systems that use |
| 3443 | TCP | User API (legacy) |
HTTPS API for users and automation (CLI, REST) on a dedicated port, distinct from the agent API and from the standalone route on port | Optional for standalone deployments. Not required for new installations. Exposed for backward compatibility when you upgrade from a release that used this port for the user API. Open this port only if your clients are configured to use it |
Administrators, CI/CD systems, and API clients that still target port |
| 7443 | TCP | Agent API (passthrough on standalone) | mTLS API for enrolled devices. On standalone Red Hat Enterprise Linux, the gateway forwards this port without terminating TLS | Required for device management so agents can sync and report status | Edge devices running the Red Hat Edge Manager agent |
For standalone deployments, the following legacy ports are not required for new installations. Open them only when your environment still uses the endpoint after an upgrade:
-
Port
443— Use inflightctl logincommands and other user API client configuration. -
Port
3443— Open only when clients still target this endpoint for the user API. -
Port
8090— Not required; download the CLI from the web console on port443. -
Port
8444— Sign-in and certificate integration use path-based routing on port443. -
Port
8445— The operating system image build API uses path-based routing on port443.
Edge devices initiate outbound connections to port 7443 on your management endpoint. On firewalls between enrolled devices and Red Hat Edge Manager, allow destination port 7443 to the host name or IP address (or route) that agents use for management.
| Port | Protocol | Service or component | Purpose | Required or optional | Counterpart |
|---|---|---|---|---|---|
| 3000 | TCP | Monitoring dashboards (Grafana) | Web UI for bundled monitoring dashboards when Grafana is exposed on this port | Optional. Required when administrators access Grafana outside the cluster or host | Browsers opening the Grafana URL |
| 4317 | TCP | Telemetry gateway (ingestion) | Primary port for ingesting device or service telemetry when the telemetry gateway is exposed | Optional. Open inbound only if telemetry sources outside the Red Hat Edge Manager network send data to this port | Edge devices or monitoring collectors configured to report telemetry to this endpoint |
| 8090 | TCP | CLI optional downloads (legacy) |
Serves optional CLI bundles or plugins on a dedicated port when this endpoint is exposed; standalone deployments use the web console on port | Optional. Not required for new standalone installations. Exposed for backward compatibility when you upgrade from a release that used this port for CLI downloads. Open inbound only if CLI hosts outside the Red Hat Edge Manager network must reach this port |
Administrator workstations or CI/CD runners that still target port |
| 8443 | TCP | External alerting integration | Inbound endpoint for external monitoring systems that connect through this port on your Red Hat Edge Manager host or exposed endpoint | Optional. Required only if external monitoring or alerting tools connect to this port | Your Prometheus, Alertmanager, or other monitoring stack, as configured in your integration |
| 8444 | TCP | Sign-in and certificate integration (legacy) |
Internal Red Hat Edge Manager service for OpenID Connect (OIDC) and enrollment certificate flows. This traffic uses path-based routing on port | Optional. Not required for new installations. You do not need an inbound firewall rule for normal sign-in or OIDC integration. Exposed for backward compatibility when you upgrade from a release that used this port. Reserve the port on the host when it is still in use, to avoid conflicts with monitoring, security, or backup tools |
Red Hat Edge Manager control plane (internal). External identity providers or browsers only if your deployment still exposes port |
| 8445 | TCP | Operating system image build API (legacy) |
API for creating and managing operating system image builds when exposed on a dedicated port; standalone deployments use path-based routing on port | Optional. Not required for new standalone installations. Exposed for backward compatibility when you upgrade from a release that used this port. Open inbound only if build clients or automation outside the Red Hat Edge Manager network still target this port |
Administrator workstations, CI/CD systems, or the Red Hat Edge Manager CLI that still target port |
| 9093 | TCP | Alertmanager (monitoring) | Alert routing and querying for the bundled Alertmanager when this port is exposed | Optional. Required when external monitoring systems connect to Alertmanager on this port | Prometheus, Alertmanager, or other monitoring tools in your stack |
| 9464 | TCP | Telemetry gateway (export) | Secondary port for telemetry export or metrics when your deployment exposes both gateway ports | Optional. Open inbound only if external systems scrape or pull telemetry from this port | Monitoring systems or collectors configured to read from this endpoint |
Port 8444 traffic is served through path-based routing on port 443, not on a separate inbound port. Plan a firewall or host rule for port 8444 only when your deployment still exposes it after an upgrade, or when you must avoid port conflicts with other host services.
Bundled monitoring can expose more than one alerting port. Port 8443 is an integration proxy endpoint; port 9093 is the conventional Alertmanager port. Your deployment might expose one or both. Confirm which ports are in use (ss, netstat, or your platform team) before you change firewall policy.
3.3. Outbound connections
Devices, the Red Hat Edge Manager deployment, and administrators often need outbound access to external services. Requirements vary by how you configure image builds, GitOps, and identity. The table lists common examples only; plan additional outbound firewall rules for every registry, identity provider, and other service your deployment uses.
| Port | Protocol | Purpose | Direction | Counterpart |
|---|---|---|---|---|
| 443 | TCP | HTTPS to container registries, Git hosting, software sources, OpenID Connect and OAuth identity providers, or Red Hat Trusted Profile Analyzer for vulnerability reporting |
Outbound from the cluster or Red Hat Edge Manager host, from | Image registries, Git servers, artifact hosts, your organization’s identity provider, or the Red Hat Trusted Profile Analyzer API and OIDC issuer used for vulnerability sync |
| 22 | TCP | SSH to Git hosts when you use SSH remotes instead of HTTPS | Outbound from build systems or from systems that run Git operations against SSH remotes | Git hosting service |
| 5432 | TCP | PostgreSQL database | Outbound from the Red Hat Edge Manager control plane to a remote PostgreSQL instance when you do not run the database on the same host as the application services |
Your organization’s PostgreSQL server (the default port is |
| 6379 | TCP | Key-value store (Redis or Valkey) | Outbound from the Red Hat Edge Manager control plane to a remote key-value store when you do not run the KV service on the same host as the application services |
Your organization’s Redis- or Valkey-compatible server (the default port is |
| 7443 | TCP | Agent API | Outbound from edge devices to the agent API port on your management endpoint | Red Hat Edge Manager management endpoint (DNS name, IP address, or route that enrolled agents are configured to use) |
Embedded PostgreSQL and key-value services on the same host use ports 5432 and 6379 locally. You only need outbound rules for those ports when the control plane connects to external instances.
Some environments also require outbound access to Network Time Protocol (NTP), DNS, or internal ticket systems; those dependencies come from your operational policies, not from Red Hat Edge Manager alone.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}