Ports Used¶
The following ports must be open before deploying the NHI Security Platform. All ports are TCP unless noted. Firewall changes should be approved for every network the platform must reach, including networks that host IIS servers and Linux devices.
Core Product Ports¶
| Port name | Source | Destination | Port | Details |
|---|---|---|---|---|
| PostgreSQL database | Primary and secondary application servers | PostgreSQL database server | 5858 | Default database connection |
| Microsoft SQL Server database | Primary and secondary application servers | Microsoft SQL Server | 1433 | Only if Microsoft SQL Server is the database |
| Web console | User machines and the secondary server | Primary application server | 5959 | Can be changed to 443 or another port |
| Web console | User machines | Secondary application server | 5959 | Only with high availability. Can be changed to 443 or another port |
| Database replication | Primary application server | Secondary application server | 5858 | Only with high availability. Replication runs in both directions, so the port must be open on both servers. For automatic failover, the standby server must be in the same subnet as the primary server. |
| Mail (SMTP over TLS) | Application server | Mail server | 587 | Email notifications using TLS |
| Mail (SMTP over SSL) | Application server | Mail server | 465 | Email notifications using SSL |
Directory, Authentication and Integration Ports¶
Required only for the features in use.
| Port name | Source | Destination | Port | Details |
|---|---|---|---|---|
| Proxy server | Primary application server | Proxy server | Your proxy's port | Only if a proxy controls internet traffic |
| Active Directory, secure | Primary application server | Active Directory domain controller | 636 | Default. Used when users sign in with Active Directory over SSL/TLS |
| Active Directory, standard | Primary application server | Active Directory domain controller | 389 | Only if SSL/TLS is not turned on for the directory connection |
| RADIUS | Application servers | RADIUS or MFA server | 1812 | Only if RADIUS-based two-factor authentication is used |
| Microsoft Entra ID | Application servers | Microsoft Entra ID (Microsoft Graph API) | 443 (HTTPS) | Only if Entra ID is used for user sign-in |
| SIEM | Application server | Your SIEM server | Your SIEM's port, for example Syslog | Forwards audit events to your security information and event management (SIEM) platform. |
Data Source Connections (NHI Only)¶
The application server connects out to each data source. Cloud and code repository sources are reached over the internet; IIS servers and Linux devices are reached on your network.
| Data source | Source | Destination | Port |
|---|---|---|---|
| AWS | Application server | AWS service APIs | 443 (HTTPS) |
| Microsoft Azure | Application server | Microsoft Graph and Azure management APIs | 443 (HTTPS) |
| GitHub | Application server | GitHub API (api.github.com) | 443 (HTTPS) |
| Bitbucket | Application server | Bitbucket API (api.bitbucket.org) | 443 (HTTPS) |
| IIS Manager | Primary application server (on-premises); remote connector (SaaS) | IIS servers | 22 (SSH) or 5986 (WinRM over HTTPS) |
| Linux devices | Primary application server (on-premises); remote connector (SaaS) | Linux devices | 22 (SSH) |
Certificate Management Connections¶
Required only when certificate management is used.
| Port name | Source | Destination | Port |
|---|---|---|---|
| Public certificate authorities | Application server | API of each CA you use (GoDaddy, The SSL Store, DigiCert, GlobalSign, Sectigo, Entrust, emSign) | 443 (HTTPS) |
| ACME providers | Application server | ACME service of each provider, for example Let's Encrypt | 443 (HTTPS) |
| ACME domain validation | ACME provider | Application server | 443 (HTTPS) |
| Certificate deployment | Primary application server (on-premises); remote connector (SaaS) | Windows systems receiving certificates (OpenSSH Server) | 22 (SSH) |
Configuration Notes¶
The web console port (default 5959) can be changed to 443 or any available port.
The Active Directory port defaults to 636. Port 389 applies only when SSL/TLS is not turned on for the directory connection.
SaaS Customers¶
Securden manages the core product ports. Data source and certificate connections start from Securden's cloud.