{ "schema_version": 2, "id": "operate/rs/networking/port-configurations", "title": "Network port configurations", "url": "https://redis.io/docs/latest/operate/rs/networking/port-configurations/", "summary": "This document describes the various network port ranges and their uses.", "tags": [ "docs", "operate", "rs" ], "last_updated": "2026-09-24T10:14:24+01:00", "page_type": "content", "content_hash": "2650e935f1863e0f41fb539fe9cd20bc5f76bb970457a27b384544a262d77bdc", "sections": [ { "id": "overview", "title": "Overview", "role": "overview", "text": "All Redis Software deployments span multiple physical/virtual nodes. You'll need to keep several ports open between these nodes. This document describes the various port ranges and their uses.\n\n> [!NOTE]\n> Whenever you create a new database, you must verify that the ports assigned to the new database's endpoints are open. The cluster will not perform this verification for you." }, { "id": "ports-and-port-ranges-used-by-redis-software", "title": "Ports and port ranges used by Redis Software", "role": "content", "text": "Redis Software's port usage falls into three general categories:\n\n- Internal: For traffic between or within cluster nodes\n- External: For traffic from client applications or external monitoring resources\n- Active-Active: For traffic to and from clusters hosting Active-Active databases\n\n| Protocol | Port | Configurable | Connection source | Description |\n|----------|------|--------------|-------------------|-------------|\n| TCP | 8001 | ❌ No | Internal, External | Traffic from application to Redis Software [Discovery Service](https://redis.io/docs/latest/operate/rs/databases/durability-ha/discovery-service) |\n| TCP | 8070 | ❌ No | External | Metrics exported and managed by the web proxy |\n| TCP | 3347-3349, 8000, 8071, 9091, 9125 | ❌ No | Internal | Internal metrics ports |\n| TCP | 8443 | ✅ Yes | Internal, External | Secure (HTTPS) access to the management web UI |\n| TCP | 9081 | ✅ Yes | Internal | CRDB coordinator for Active-Active management (internal) |\n| TCP | 9082 | ❌ No | Internal | Cluster API internal port |\n| TCP | 9443, 8080, 3346 | ✅ Yes | Internal, External, Active-Active | REST API traffic, including cluster management and node bootstrap |\n| TCP | 10050 | ❌ No | Internal | Zabbix monitoring |\n| TCP | 10000-10049, 10051-19999 | ✅ Yes | Internal, External, Active-Active | Database traffic |\n| UDP | 53, 5353 | ❌ No | Internal, External | DNS/mDNS traffic |\n| TCP | 1968 | ❌ No | Internal | Proxy traffic |\n| TCP | 3333-3345, 3350-3354, 36379 | ❌ No | Internal | Internode communication |\n| TCP | 3355 | ✅ Yes | Internal | Authentication service internal port |\n| TCP | 3357 | ❌ No | Internal | Internal communication |\n| TCP | 20000-29999 | ❌ No | Internal | Database shard traffic |\n| TCP | 8002, 8004, 8006 | ✅ Yes | Internal | Default system health monitoring (envoy admin, envoy management server, gossip envoy admin)|\n| TCP | 8444, 9080 | ❌ No | Internal | Traffic between web proxy and cnm_http/cm |\n\n> [!NOTE]\n> The cluster uses ports 20000-29999 for internal shard traffic. You can't change the range, but `reserved_ports` excludes specific ports or port ranges from shard assignment." }, { "id": "change-port-configuration", "title": "Change port configuration", "role": "content", "text": "" }, { "id": "reserve-ports", "title": "Reserve ports", "role": "content", "text": "Redis Software reserves some ports by default (`system_reserved_ports`). To reserve other ports or port ranges and prevent the cluster from assigning them to database endpoints or internal shard traffic, configure `reserved_ports` using one of the following methods:\n\n- [rladmin cluster config](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin/cluster/config)\n\n [code example]\n\n For example:\n\n [code example]\n\n- [Update cluster settings](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/cluster#put-cluster) REST API request\n\n [code example]\n\n For example:\n\n [code example]" }, { "id": "change-the-cluster-manager-ui-port", "title": "Change the Cluster Manager UI port", "role": "content", "text": "The Redis Software Cluster Manager UI uses port 8443, by default. You can change this to a custom port as long as the new port is not in use by another process.\n\nTo change this port, run:\n\n[code example]\n\nAfter you change the Cluster Manager UI port, use the new port in the URL when accessing the UI on any node in the cluster. Example: `https://newnode.mycluster.example.com:`" }, { "id": "change-the-envoy--ports", "title": "Change the envoy ports", "role": "content", "text": "For system health monitoring, Redis uses the following ports by default:\n\n- Port 8002 for envoy admin\n\n- Port 8004 for envoy management server\n\n- Port 8006 for gossip envoy admin\n\nYou can change each envoy port to a custom port using the [`rladmin cluster config`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin/cluster/config) command as long as the new port is not in use by another process. When you change `envoy_admin_port`, expect a restart of envoy.\n\nTo change the envoy admin port, run:\n\n[code example]\n\nTo change the envoy management server port, run:\n\n[code example]\n\nTo change the gossip envoy admin port, run:\n\n[code example]" }, { "id": "change-the-rest-api-port", "title": "Change the REST API port", "role": "content", "text": "For the REST API, Redis Software uses port 9443 (secure) and port 8080 (not secure), by default. You can change this to a custom port as long as the new port is not in use by another process.\n\nTo change these ports, run:\n\n[code example]\n\n[code example]" }, { "id": "os-conflicts-with-port-53", "title": "OS conflicts with port 53", "role": "content", "text": "If port 53 is in use, the installation fails. This issue can occur in default installations of certain operating systems in which `systemd-resolved` (DNS server) or `dnsmasq` is running.\n\nTo prevent this issue, change the system configuration to make this port available before installation.\n\nTo prevent `systemd-resolved` from using port 53:\n\n1. Edit `/etc/systemd/resolved.conf`: \n\n [code example]\n\n1. Add `DNSStubListener=no` as the last line in the file and save the file.\n\n1. Rename the current `/etc/resolv.conf` file:\n\n [code example]\n\n1. Create a symbolic link for `/etc/resolv.conf`:\n\n [code example]\n\n > [!NOTE]\n > You might encounter a temporary name resolution error (`sudo: unable to resolve host {hostname}: Temporary failure in name resolution`), which should be fixed when you restart `systemd-resolved` in the next step.\n\n2. Restart the DNS service:\n\n [code example]\n\nTo prevent `dnsmasq` from using port 53:\n\n1. Stop the `dnsmasq` service if it's running:\n\n [code example]\n\n1. Prevent `dnsmasq` from starting automatically at system boot:\n\n [code example]\n\n1. Mask `dnsmasq` to prevent it from being started manually or by other services:\n\n [code example]\n\n1. Verify `dnsmasq` is no longer active and won't start at system boot:\n\n [code example]" }, { "id": "update-sysctlconf-to-avoid-port-collisions", "title": "Update `sysctl.conf` to avoid port collisions", "role": "content", "text": "To avoid port collision, update `/etc/sysctl.conf` to include:\n\n[code example]" }, { "id": "configure-https", "title": "Configure HTTPS", "role": "configuration", "text": "" }, { "id": "require-https-for-api-endpoints", "title": "Require HTTPS for API endpoints", "role": "content", "text": "By default, the Redis Software API supports communication over HTTP and HTTPS. However, you can turn off HTTP support to ensure that API requests are encrypted.\n\nBefore you turn off HTTP support, make sure you migrate any scripts or proxy configurations that use HTTP to the encrypted API endpoint to prevent broken connections.\n\nTo turn off HTTP support for API endpoints, run:\n\n[code example]\n\nAfter you turn off HTTP support, traffic sent to the unencrypted API endpoint is blocked." }, { "id": "http-to-https-redirection", "title": "HTTP to HTTPS redirection", "role": "content", "text": "Starting with version 6.0.12, you cannot use automatic HTTP to HTTPS redirection.\nTo poll metrics from the `metrics_exporter` or to access the Cluster Manager UI, use HTTPS in your request. HTTP requests won't be automatically redirected to HTTPS for those services." }, { "id": "nodes-on-different-vlans", "title": "Nodes on different VLANs", "role": "content", "text": "Nodes in the same cluster must reside on the same VLAN. If you can't\nhost the nodes on the same VLAN, then you must open [all ports](https://redis.io/docs/latest/operate/rs/networking/port-configurations) between them." } ], "examples": [ { "id": "reserve-ports-ex0", "language": "sh", "code": "rladmin cluster config reserved_ports ", "section_id": "reserve-ports" }, { "id": "reserve-ports-ex1", "language": "sh", "code": "rladmin cluster config reserved_ports 11000 13000-13010 20048", "section_id": "reserve-ports" }, { "id": "reserve-ports-ex2", "language": "sh", "code": "PUT /v1/cluster\n { \"reserved_ports\": [\"list of ports/port ranges\"] }", "section_id": "reserve-ports" }, { "id": "reserve-ports-ex3", "language": "sh", "code": "PUT /v1/cluster\n { \"reserved_ports\": [\"11000\", \"13000-13010\", \"20048\"] }", "section_id": "reserve-ports" }, { "id": "change-the-cluster-manager-ui-port-ex0", "language": "sh", "code": "rladmin cluster config cm_port ", "section_id": "change-the-cluster-manager-ui-port" }, { "id": "change-the-envoy--ports-ex0", "language": "sh", "code": "$ rladmin cluster config envoy_admin_port \nUpdating envoy_admin_port... restarting now", "section_id": "change-the-envoy--ports" }, { "id": "change-the-envoy--ports-ex1", "language": "sh", "code": "$ rladmin cluster config envoy_mgmt_server_port \nCluster configured successfully", "section_id": "change-the-envoy--ports" }, { "id": "change-the-envoy--ports-ex2", "language": "sh", "code": "$ rladmin cluster config gossip_envoy_admin_port \nCluster configured successfully", "section_id": "change-the-envoy--ports" }, { "id": "change-the-rest-api-port-ex0", "language": "sh", "code": "rladmin cluster config cnm_http_port ", "section_id": "change-the-rest-api-port" }, { "id": "change-the-rest-api-port-ex1", "language": "sh", "code": "rladmin cluster config cnm_https_port ", "section_id": "change-the-rest-api-port" }, { "id": "os-conflicts-with-port-53-ex0", "language": "sh", "code": "sudo vi /etc/systemd/resolved.conf", "section_id": "os-conflicts-with-port-53" }, { "id": "os-conflicts-with-port-53-ex1", "language": "sh", "code": "sudo mv /etc/resolv.conf /etc/resolv.conf.orig", "section_id": "os-conflicts-with-port-53" }, { "id": "os-conflicts-with-port-53-ex2", "language": "sh", "code": "sudo ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf", "section_id": "os-conflicts-with-port-53" }, { "id": "os-conflicts-with-port-53-ex3", "language": "sh", "code": "sudo service systemd-resolved restart", "section_id": "os-conflicts-with-port-53" }, { "id": "os-conflicts-with-port-53-ex4", "language": "sh", "code": "sudo systemctl stop dnsmasq", "section_id": "os-conflicts-with-port-53" }, { "id": "os-conflicts-with-port-53-ex5", "language": "sh", "code": "sudo systemctl disable dnsmasq", "section_id": "os-conflicts-with-port-53" }, { "id": "os-conflicts-with-port-53-ex6", "language": "sh", "code": "sudo systemctl mask dnsmasq", "section_id": "os-conflicts-with-port-53" }, { "id": "os-conflicts-with-port-53-ex7", "language": "sh", "code": "sudo systemctl status dnsmasq", "section_id": "os-conflicts-with-port-53" }, { "id": "update-sysctlconf-to-avoid-port-collisions-ex0", "language": " sh", "code": "net.ipv4.ip_local_port_range = 30000 65535", "section_id": "update-sysctlconf-to-avoid-port-collisions" }, { "id": "require-https-for-api-endpoints-ex0", "language": "sh", "code": "rladmin cluster config http_support disabled", "section_id": "require-https-for-api-endpoints" } ] }