# Default ports

Publish only the ports a Zato environment needs and keep the rest closed.

A Zato environment listens on the same ports under [Docker](https://zato.io/docs/admin/guide/install/docker.html) and [Kubernetes](https://zato.io/docs/admin/guide/kubernetes.html).

You change each port through its environment variable - for what each variable does, see the [environment variables reference](https://zato.io/tutorials/devops/env-variables.html).

| Port | Environment variable | Direction | Purpose |
| --- | --- | --- | --- |
| 8183 | `Zato_Port_Dashboard` | Inbound | Your browser - the Dashboard |
| 8184 | `Zato_Port_Dashboard_SSL` | Inbound | TLS variant of the Dashboard port |
| 8185 | `Zato_Port_OpenAPI_Console` | Inbound | Your browser - the OpenAPI console |
| 8186 | `Zato_Port_OpenAPI_Console_SSL` | Inbound | TLS variant of the OpenAPI console port |
| 11223 | `Zato_Port_Load_Balancer` | Inbound | External API clients - REST and HTTP traffic through the load balancer |
| 11224 | `Zato_Port_Load_Balancer_SSL` | Inbound | TLS variant of the load balancer port |
| 11553 | `Zato_Port_MLLP` | Inbound | HL7 MLLP traffic from clinical systems |
| 11554 | `Zato_Port_MLLP_SSL` | Inbound | TLS variant of the MLLP port |
| 22 | `Zato_Port_SSH` | Inbound | SSH access to the container - under Kubernetes, `kubectl exec` covers this role and the port stays closed |

External API clients connect through the load balancer ports and clinical systems through the MLLP ports. The two kinds of traffic do not mix: 11223 and 11224 are for HTTP, 11553 and 11554 are for HL7 MLLP, and the load balancer refuses an MLLP message sent to the HTTP port rather than forwarding it.

## The load balancer's own endpoints {#the-load-balancers-own-endpoints}

The load balancer serves one endpoint directly, separately from the traffic it forwards:

- **`GET /` on 11223 and 11224** returns `200 OK` with `{"is_ok":true}` - a static JSON health response that confirms the load balancer is up, without calling the server behind it.

## Ports to publish in production {#ports-to-publish-in-production}

A port is only reachable if you publish it with `-p`. In a firewall, the same list is the allow-list of inbound rules - every other port stays closed.

| Port | In production |
| --- | --- |
| 11224 | Publish. This is how API clients reach you |
| 11223 | Do not publish. It is the same traffic without TLS |
| 11554 | Publish if clinical systems send you HL7 MLLP traffic |
| 11553 | Do not publish. It is the same traffic without TLS |
| 8184 | Publish only to your own network - a VPN, an office range, a bastion |
| 8183 | Do not publish. Same as 8184 without TLS |
| 8186, 8185 | Publish 8186 only if API consumers browse your OpenAPI console |
| 22 | Do not publish. `docker exec` and `kubectl exec` do the same job without an open port |

## Outbound {#outbound}

A firewall that blocks outbound traffic by default breaks the connections below, so allow outbound access for:

- Your own outgoing connections, to the endpoints they call
- [Health checks](https://zato.io/docs/admin/health-checks.html), which call the outgoing connections they watch
- Shipping logs or metrics out, if you push them rather than having them scraped

## See also {#see-also}

- [Kubernetes](https://zato.io/docs/admin/guide/kubernetes.html) - Routing external traffic to the same ports from inside a cluster
- [Production security checklist](https://zato.io/docs/admin/security/checklist.html) - What to change, close and verify before production traffic
- [Environment variables](https://zato.io/tutorials/devops/env-variables.html) - The Zato\_Port\_\* variables and the rest of the reference

## Learn more {#learn-more}

- [Production checklist](https://zato.io/docs/admin/production-checklist.html) - What to confirm before an environment takes real traffic
- [Audit log](https://zato.io/docs/admin/audit-log/) - Every request, response and error, and what you can do with them afterwards
- [Health checks](https://zato.io/docs/admin/health-checks.html) - Have Zato ping your outgoing connections instead of waiting for traffic to fail
- [Logging](https://zato.io/docs/admin/logging.html) - What is written where, and how to ship it to Splunk, Loki, Elastic or Datadog
- [GitOps with enmasse](https://zato.io/docs/admin/enmasse.html) - Keep the whole environment in git as YAML and import it anywhere