Default ports
Publish only the ports a Zato environment needs and keep the rest closed.
A Zato environment listens on the same ports under Docker and Kubernetes.
You change each port through its environment variable - for what each variable does, see the environment variables reference.
| Port | Environment variable | Direction | Purpose |
|---|---|---|---|
| 8183 | Zato_Port_Dashboard | Inbound | Your browser - the Dashboard |
| 8184 | Zato_Port_Dashboard_SSL | Inbound | TLS variant of the Dashboard port |
| 8185 | Zato_Port_OpenAPI_Console | Inbound | Your browser - the OpenAPI console |
| 8186 | Zato_Port_OpenAPI_Console_SSL | Inbound | TLS variant of the OpenAPI console port |
| 11223 | Zato_Port_Load_Balancer | Inbound | External API clients - REST and HTTP traffic through the load balancer |
| 11224 | Zato_Port_Load_Balancer_SSL | Inbound | TLS variant of the load balancer port |
| 11553 | Zato_Port_MLLP | Inbound | HL7 MLLP traffic from clinical systems |
| 11554 | Zato_Port_MLLP_SSL | Inbound | TLS variant of the MLLP port |
| 22 | Zato_Port_SSH | Inbound | SSH access to the container - under Kubernetes, kubectl exec covers this role and the port stays closed |
External API clients connect through the load balancer ports and clinical systems through the MLLP ports. The two kinds of traffic do not mix: 11223 and 11224 are for HTTP, 11553 and 11554 are for HL7 MLLP, and the load balancer refuses an MLLP message sent to the HTTP port rather than forwarding it.
The load balancer's own endpoints
The load balancer serves one endpoint directly, separately from the traffic it forwards:
GET /on 11223 and 11224 returns200 OKwith{"is_ok":true}- a static JSON health response that confirms the load balancer is up, without calling the server behind it.
Ports to publish in production
A port is only reachable if you publish it with -p. In a firewall, the same list is the allow-list of inbound rules - every other port stays closed.
| Port | In production |
|---|---|
| 11224 | Publish. This is how API clients reach you |
| 11223 | Do not publish. It is the same traffic without TLS |
| 11554 | Publish if clinical systems send you HL7 MLLP traffic |
| 11553 | Do not publish. It is the same traffic without TLS |
| 8184 | Publish only to your own network - a VPN, an office range, a bastion |
| 8183 | Do not publish. Same as 8184 without TLS |
| 8186, 8185 | Publish 8186 only if API consumers browse your OpenAPI console |
| 22 | Do not publish. docker exec and kubectl exec do the same job without an open port |
Outbound
A firewall that blocks outbound traffic by default breaks the connections below, so allow outbound access for:
- Your own outgoing connections, to the endpoints they call
- Health checks, which call the outgoing connections they watch
- Shipping logs or metrics out, if you push them rather than having them scraped
See also
| Page | What it covers |
|---|---|
| Kubernetes | Routing external traffic to the same ports from inside a cluster |
| Production security checklist | What to change, close and verify before production traffic |
| Environment variables | The Zato_Port_* variables and the rest of the reference |