Default ports
Publish only the ports a Zato environment needs and keep the rest closed.
A Zato environment listens on the same ports under Docker and Kubernetes.
You change each port through its environment variable - for what each variable does, see the environment variables reference.
| Port | Environment variable | Direction | Purpose |
|---|---|---|---|
| 8183 | Zato_Port_Dashboard | Inbound | Your browser - the Dashboard |
| 8184 | Zato_Port_Dashboard_SSL | Inbound | TLS variant of the Dashboard port |
| 8185 | Zato_Port_OpenAPI_Console | Inbound | Your browser - the OpenAPI console |
| 8186 | Zato_Port_OpenAPI_Console_SSL | Inbound | TLS variant of the OpenAPI console port |
| 11223 | Zato_Port_Load_Balancer | Inbound | External API clients - REST and HTTP traffic through the load balancer |
| 11224 | Zato_Port_Load_Balancer_SSL | Inbound | TLS variant of the load balancer port |
| 11553 | Zato_Port_MLLP | Inbound | HL7 MLLP traffic from clinical systems |
| 11554 | Zato_Port_MLLP_SSL | Inbound | TLS variant of the MLLP port |
| 8404 | Zato_Port_Load_Balancer_Stats | Inbound | The load balancer's own stats and metrics - /stats and /metrics, described below |
| 22 | Zato_Port_SSH | Inbound | SSH access to the container - under Kubernetes, kubectl exec covers this role and the port stays closed |
External API clients connect through the load balancer ports and clinical systems through the MLLP ports. The two kinds of traffic do not mix: 11223 and 11224 are for HTTP, 11553 and 11554 are for HL7 MLLP, and the load balancer refuses an MLLP message sent to the HTTP port rather than forwarding it.
The load balancer's own endpoints
The load balancer serves two endpoints directly, separately from the traffic it forwards:
GET /on 11223 and 11224 returns200 OKwith{"is_ok":true}- a static JSON health response that confirms the load balancer is up, without calling the server behind it.- Port 8404 serves the load balancer's
/statspage and its Prometheus/metricsendpoint. Each endpoint requires its own HTTP Basic Auth user - thestatsuser withZato_Load_Balancer_Stats_Passwordand themetricsuser withZato_Load_Balancer_Metrics_Password, both in the environment variables reference.
Ports to publish in production
A port is only reachable if you publish it with -p. In a firewall, the same list is the allow-list of inbound rules - every other port stays closed.
| Port | In production |
|---|---|
| 11224 | Publish. This is how API clients reach you |
| 11223 | Do not publish. It is the same traffic without TLS |
| 11554 | Publish if clinical systems send you HL7 MLLP traffic |
| 11553 | Do not publish. It is the same traffic without TLS |
| 8184 | Publish only to your own network - a VPN, an office range, a bastion |
| 8183 | Do not publish. Same as 8184 without TLS |
| 8186, 8185 | Publish 8186 only if API consumers browse your OpenAPI console |
| 8404 | Publish only to your own network, for the monitoring that scrapes the load balancer |
| 22 | Do not publish. docker exec and kubectl exec do the same job without an open port |
Outbound
A firewall that blocks outbound traffic by default breaks the connections below, so allow outbound access for:
- Your own outgoing connections, to the endpoints they call
- Alert notifications - Slack, Teams and webhook targets are HTTPS calls out of the container, and SMTP is a call to your mail server
- Health checks, which call the outgoing connections they watch
- Shipping logs or metrics out, if you push them rather than having them scraped
See also
| Page | What it covers |
|---|---|
| Kubernetes | Routing external traffic to the same ports from inside a cluster |
| Production security checklist | What to change, close and verify before production traffic |
| Environment variables | The Zato_Port_* variables and the rest of the reference |