# Firewall port **URL:** \ **Category:** Elasticsearch\ **Created:** [March 18, 2019, 3:11am UTC](https://discuss.elastic.co/t/firewall-port/172702 "2019-03-18T03:11:40Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![junhyuk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/junhyuk/32/41948_2.png) [@junhyuk](https://discuss.elastic.co/u/junhyuk)\ **Post date:** [March 18, 2019, 3:11am UTC](https://discuss.elastic.co/t/firewall-port/172702/1 "2019-03-18T03:11:40Z")
Hi there, I have a question, It is about firewall. I have to open port firewall to test elasticsearch on my server. To open port need some roles, It is starting IP/port , destination IP/port So I think both starting IP and destination IP are same as my server ip, and **starting port number is 80 , destination port is 9200**. Is it right? I am really wonder about it. please help me. ---
**Author:** ![mjunaidmuzammil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mjunaidmuzammil/32/56910_2.png) [@mjunaidmuzammil](https://discuss.elastic.co/u/mjunaidmuzammil)\ **Post date:** [March 18, 2019, 8:21am UTC](https://discuss.elastic.co/t/firewall-port/172702/2 "2019-03-18T08:21:19Z")
> [@junhyuk](#): > > To open port need some roles, It is starting IP/port , destination IP/port I am not sure, what you mean by starting IP/port. The ports that you need to open in your firewall on ES server node depends upon your cluster topology. If you are creating a cluster, you'll have to open up both the HTTP port and Transport Port in your firewall (by default 9200 for HTTP and 9300 for transport). For single node cluster, you don't need to open up transport port. ---
**Author:** ![junhyuk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/junhyuk/32/41948_2.png) [@junhyuk](https://discuss.elastic.co/u/junhyuk)\ **Post date:** [March 18, 2019, 9:58am UTC](https://discuss.elastic.co/t/firewall-port/172702/3 "2019-03-18T09:58:34Z")
![firewall](https://us1.discourse-cdn.com/elastic/original/3X/3/e/3ec8bdf99031f908702d067702f15753d9d7d592.png) Thank you so much. But I curious is these(A,B) plz told me. (I have single node so don't need 9300 port) ---
**Author:** ![mjunaidmuzammil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mjunaidmuzammil/32/56910_2.png) [@mjunaidmuzammil](https://discuss.elastic.co/u/mjunaidmuzammil)\ **Post date:** [March 18, 2019, 11:21am UTC](https://discuss.elastic.co/t/firewall-port/172702/4 "2019-03-18T11:21:01Z")
_my server_: can make a connection using any of the source ports to the server listening over port 9200. The inbound port 9200 should be enabled on ElasticSearch server. ---
**Author:** ![junhyuk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/junhyuk/32/41948_2.png) [@junhyuk](https://discuss.elastic.co/u/junhyuk)\ **Post date:** [March 18, 2019, 11:30am UTC](https://discuss.elastic.co/t/firewall-port/172702/5 "2019-03-18T11:30:48Z")
Oh, thanks. So base on my server(installed elasticsearch) I can choose outbound ports (example 80). And inbound ports is 9200 right? so should I configure source ip is any? I really hope your answer. thanks. ---
**Author:** ![mjunaidmuzammil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mjunaidmuzammil/32/56910_2.png) [@mjunaidmuzammil](https://discuss.elastic.co/u/mjunaidmuzammil)\ **Post date:** [March 18, 2019, 12:11pm UTC](https://discuss.elastic.co/t/firewall-port/172702/6 "2019-03-18T12:11:17Z")
You should enable all the outbound ports, because clients can try connecting to ES server from any port. You should fix outbound port only if you are sure that client processes will be initiated from port 80. Inbound firewall rule for port 9200 can be set on ES server. ---
**Author:** ![junhyuk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/junhyuk/32/41948_2.png) [@junhyuk](https://discuss.elastic.co/u/junhyuk)\ **Post date:** [March 19, 2019, 1:07am UTC](https://discuss.elastic.co/t/firewall-port/172702/7 "2019-03-19T01:07:04Z")
Ok I will try from this way. Starting IP and Destination IP are my server IP? Or should I set Starting IP anywhere? I really appreciate you. ---
**Author:** ![mjunaidmuzammil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mjunaidmuzammil/32/56910_2.png) [@mjunaidmuzammil](https://discuss.elastic.co/u/mjunaidmuzammil)\ **Post date:** [March 19, 2019, 8:05am UTC](https://discuss.elastic.co/t/firewall-port/172702/8 "2019-03-19T08:05:58Z")
For better security, you should restrict the interface to as minimum interfaces as possible. So ideally it should be restricted to the interface from where it will be queried. Along with the default 9200 port, you may need to expose some other ports for SSH access to the server. There are some best practices listed out for firewall rules [here](https://www.liquidweb.com/kb/best-practices-for-firewall-rules/), please refer to it. ---
**Author:** ![junhyuk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/junhyuk/32/41948_2.png) [@junhyuk](https://discuss.elastic.co/u/junhyuk)\ **Post date:** [March 20, 2019, 11:03am UTC](https://discuss.elastic.co/t/firewall-port/172702/9 "2019-03-20T11:03:40Z")
okey, If I have more question, Can I ask you again? Thanks. ---
**Author:** ![junhyuk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/junhyuk/32/41948_2.png) [@junhyuk](https://discuss.elastic.co/u/junhyuk)\ **Post date:** [March 21, 2019, 10:27am UTC](https://discuss.elastic.co/t/firewall-port/172702/11 "2019-03-21T10:27:07Z")
![firewall2](https://us1.discourse-cdn.com/elastic/original/3X/1/1/11deb8ef516d2d33805e9a3f54f318783945e7ec.png) Hi there, I really couldn't understand about firewall and port.. this painting is right? If is right, what should I configure 'A' ip? ---
**Author:** ![BennyInc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bennyinc/32/21751_2.png) [@BennyInc](https://discuss.elastic.co/u/BennyInc)\ **Post date:** [March 21, 2019, 12:48pm UTC](https://discuss.elastic.co/t/firewall-port/172702/12 "2019-03-21T12:48:39Z")
If you open a request from machine A to machine B (which runs your elastic node), you should only be interested in the port on machine B, which is 9200 by default. So you can open Port 9200 inbound on machine B. Otherwise machine A won't be able to connect. The reply from the elastic node will always be sent back to machine A on the source port that machine A used to initiate the connection. Your elastic node will never initiate that connection, but only reply on the connection that machine A opened. ---
**Author:** ![junhyuk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/junhyuk/32/41948_2.png) [@junhyuk](https://discuss.elastic.co/u/junhyuk)\ **Post date:** [March 22, 2019, 1:13am UTC](https://discuss.elastic.co/t/firewall-port/172702/13 "2019-03-22T01:13:06Z")
Hi Benny, your mean is my server = elastic server and how to connect my server and elasticserver? my server outbound = elasticserver inbound = 9200 port? I am very confuse..Thanks. ---
**Author:** ![BennyInc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bennyinc/32/21751_2.png) [@BennyInc](https://discuss.elastic.co/u/BennyInc)\ **Post date:** [March 22, 2019, 11:53am UTC](https://discuss.elastic.co/t/firewall-port/172702/14 "2019-03-22T11:53:21Z")
I assume your firewall sits in front of your elastic server. It then needs to allow 9200 inbound to the elastic server. That should be all you need. ---
**Author:** ![junhyuk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/junhyuk/32/41948_2.png) [@junhyuk](https://discuss.elastic.co/u/junhyuk)\ **Post date:** [March 23, 2019, 1:46am UTC](https://discuss.elastic.co/t/firewall-port/172702/15 "2019-03-23T01:46:45Z")
So.. what does elastic server mean? It is my server with ES tool installed? or different? thanks. ---
**Author:** ![BennyInc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bennyinc/32/21751_2.png) [@BennyInc](https://discuss.elastic.co/u/BennyInc)\ **Post date:** [March 25, 2019, 9:41am UTC](https://discuss.elastic.co/t/firewall-port/172702/16 "2019-03-25T09:41:40Z")
Yes, by elastic server I meant the one that you have installed elasticsearch on. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 22, 2019, 9:44am UTC](https://discuss.elastic.co/t/firewall-port/172702/17 "2019-04-22T09:44:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.