Sisense Required Ports for Linux

Last updated: October 21, 2026

Tier Deployment
Enterprise On-Prem

Previous Step:

Sisense uses certain ports to communicate with machines on the Internet and within your Sisense namespace. Below is a description of the ports that you may need to allow in your deployment.

Note:

In cluster deployments, open all traffic between the nodes (TCP and UDP).

Note:

During a first online on-prem (RKE2) installation, sisense.sh stops and disables the host firewall service (firewalld or ufw) on every node. Firewalls outside the hosts, such as cloud security groups or network firewalls, still need the rules described on this page.


Outbound Rules for Sisense

Ports Description
80, 443

Allow outbound TCP connections from the workers to these ports to allow worker node updates and reloads.

Additionally, outbound communication on port 443 to https://l.sisense.com for licensing.
2049

Allow outbound TCP and UDP connections to this port to allow mounting file storage as volumes.

This is only relevant when using NFS and only for the NFS server.
3260 Allow outbound TCP and UDP connections to this port for communication to block storage.
8071 Allow outbound connections to the Sisense external monitoring system.
10250

Allow inbound TCP and UDP connections to this port for the Kubernetes dashboard and commands such as kubectl logs and kubectl exec.

For EKS, AKS and GKE need to be open towards the K8S control.

Outbound Connectivity (Destination Hosts)

In addition to the outbound port rules above, an online installation or upgrade reaches the external destinations listed below. These hosts must be reachable (typically over TCP 443, with some over TCP 80) from the machine that runs sisense.sh and from the Sisense nodes before installation. Hosts are not required for an offline (air-gapped) installation — see Installing Sisense in an Offline Environment.

Note:

This list reflects the current Sisense release and may differ for older releases. The Required When column indicates the conditions under which each destination is contacted; entries that apply to a specific OS, cloud provider, or configuration flag are only relevant when that condition is met.

Hosts marked Pre-flight check are the hosts that sisense.sh tests from the install machine before it starts the installation (on port 443, and on port 80 for mirror.centos.org). The other hosts are not tested in advance; if one of them is blocked, the installation fails at the step that needs it.

Host Port Protocol Applies To Required When Notes

ubuntu.com

443

TCP

Ubuntu

Online install

Pre-flight check. APT ecosystem

archive.ubuntu.com

443

TCP

Ubuntu

Online install (Ubuntu)

Common APT mirror

security.ubuntu.com

443

TCP

Ubuntu

Online install (Ubuntu)

Common APT security updates

dl.fedoraproject.org

443

TCP

Red Hat; CentOS; Rocky; Oracle Linux; Amazon Linux

Online install

Pre-flight check. EPEL packages

mirror.centos.org

80

TCP

Red Hat; CentOS; Rocky; Oracle Linux; Amazon Linux

Online install

Pre-flight check. YUM/DNF mirrors

cdn.amazonlinux.com

443

TCP

Amazon Linux

Online install (Amazon Linux)

Amazon Linux package mirrors (amazon-linux-extras / dnf)

subscription.rhsm.redhat.com

443

TCP

Red Hat

RHEL with subscription-manager

RHEL subscription access

docker.io

443

TCP

All

Online install

Pre-flight check. Docker Hub

registry-1.docker.io

443

TCP

All

Online install

Pre-flight check. Docker Hub registry API

download.docker.com

443

TCP

All

Online install

Pre-flight check. Docker packages/repos

quay.io

443

TCP

All

Online install

Pre-flight check. Default image registry (quay.io/sisense_release); Rook Ceph images

gcr.io

443

TCP

All

Online install

Pre-flight check. Google container registry

storage.googleapis.com

443

TCP

All

Online install

Pre-flight check. GCR/GCS-backed artifacts

github.com

443

TCP

All

Online install

Pre-flight check. Helmfile; pip git dependencies (e.g. pssh on AL2023); release assets

raw.githubusercontent.com

443

TCP

All

On-prem RKE2 online install

Fallback location of the RKE2 install script, used when get.rke2.io is not available

release-assets.githubusercontent.com

443

TCP

All

On-prem RKE2 online install

RKE2 release binaries (via get.rke2.io)

bitbucket.org

443

TCP

All

Online install

Pre-flight check. Legacy/third-party references

pypi.org

443

TCP

All

Online install

Pre-flight check. Python installer dependencies

files.pythonhosted.org

443

TCP

All

Online install

Python package wheels

kubernetes.io

443

TCP

All

Online install

Pre-flight check. Kubernetes-related references

l.sisense.com

443

TCP

All

Online install

Pre-flight check. Sisense licensing/artifacts

auth.cloud.sisense.com

443

TCP

All

Online install

Pre-flight check. Sisense cloud authentication

get.rke2.io

443

TCP

All

On-prem RKE2 online install (not offline, existing clusters, or OpenShift)

RKE2 install script. The installer installs a fixed RKE2 version.

dl.k8s.io

443

TCP

All

Online install

kubectl binary download

get.helm.sh

443

TCP

All

Online install

Helm binary download

registry.k8s.io

443

TCP

All

storage_type=nfs

NFS CSI driver images (default baseRepo)

kyverno.github.io

443

TCP

All

signature_validation=true

Kyverno Helm chart repository

kubernetes.github.io

443

TCP

All

cloud_provider=aws and fresh infra

AWS cloud-controller-manager Helm repo

data.sisense.com

443

TCP

All

Helm installations; optional AWS ALB setup

Sisense Helm chart repository (https://data.sisense.com/linux/helm/charts/fusion); optional Sisense scripts (e.g. aws-alb-iam-attach.sh)

documentation.sisense.com

443

TCP

All

Documentation links only

Sisense docs (not required for install automation)

<docker_registry from config>

443

TCP

All

private_docker_registry=true or custom registry

User-defined registry host; default quay.io/sisense_release on quay.io

*.amazonaws.com

443

TCP

All

AWS cloud (EBS/EFS/FSx/EC2 API)

AWS service endpoints (region-specific)

metadata.google.internal

80

TCP

All

GKE nodes

GCE metadata (link-local; not public internet)

169.254.169.254

80

TCP

All

AWS EC2 nodes

EC2 instance metadata (link-local; not public internet)

AI & Control-Plane Connectivity

Deployments that use Sisense AI/GenAI features require outbound access (TCP 443) to the external service providers below. Unlike the installer hosts above, these are provider endpoints with no single fixed Sisense-owned FQDN — the exact destination depends on your provider, region, and configuration. For on-prem deployments, you supply the target service URL; for control-plane services, the destinations are reached on your behalf.

On-Prem (client-provided target service URL)

Destination Description

LLM provider

Access to the LLM provider. Currently Azure OpenAI; AWS Bedrock support is planned.

MongoDB Atlas

Access to the Vector database used by Sisense AI features.

Arria

Access to the narration service provider.

Control-Plane Services (LLM Gateway, Similarity Service)

Destination Description

AWS Secret Manager (ASM)

Access to AWS Secret Manager.

LLM provider

Access to the LLM provider. Currently Azure OpenAI; AWS Bedrock support is planned.

MongoDB Atlas

Access to MongoDB Atlas maintained by Sisense.

Inbound Rules for Sisense

The following ports should be opened to your network so you will be able to access the Sisense application, Grafana, SSH, and the Kubernetes API:

Ports Description

TCP 30845

Sisense web application over HTTP, on the default gateway_port. Used when SSL is disabled and no cloud load balancer or AWS ALB is configured.

TCP 443

Sisense web application over HTTPS, when SSL is enabled.

TCP 30300

Grafana. Only when internal monitoring is enabled (internal_monitoring: true). You can change the port with grafana_port.

TCP 22

SSH from the machine that runs sisense.sh to every node. Needed only for on-prem (RKE2) installations. Installations on an existing cluster (EKS, AKS, GKE, or OpenShift), Provisioner installations, and Helm installations do not use SSH.

TCP 6443

Kubernetes API server. The machine that runs sisense.sh (or kubectl and helm) must reach it. Also needed for administrator access to the cluster.

Cluster Mode

When deploying multiple nodes on-prem (RKE2), the following ports should be opened between each node:

Ports Description

TCP 6443

Kubernetes API server

TCP 9345

RKE2 supervisor. The other nodes register with the first node on this port.

TCP 2379 - 2380

etcd

TCP 2381

etcd metrics (internal monitoring)

TCP 10250

kubelet

TCP 10248 - 10259

Kubernetes

TCP 179

Calico - BGP

TCP 9099

Calico - health checks

TCP 5473, 9098

Calico

UDP 4789

Calico - VXLAN

TCP 9100

Node exporter. Only when internal monitoring is enabled.

TCP 9080, 9081

Rook Ceph CSI health checks. Only when storage_type: rook-ceph.
Note:

Before it installs Kubernetes, the sisense.sh pre-flight check verifies on each node that TCP ports 80, 179, 443, 2376, 2379, 2380, 6443, 8181, 9099, 10248, 10249, 10250, 10251, 10252, 10254, 10255, 10256, 10257, and 10259 are not already in use (and 9080 and 9081 when you use Rook Ceph). It does not test connectivity between the nodes. In particular, it does not check TCP 9345: if this port is blocked between the nodes, the pre-flight check passes, but the other nodes cannot join the cluster.

Cluster Network Plugin

On-prem installations use RKE2 with the Calico network plugin (cni_plugin: calico, the default). Calico secures the communication between your nodes. The Calico ports are listed in the table above.

The installer configures the following internal networks. Make sure these ranges do not overlap with networks that your nodes or users need to reach. To use different ranges, set the parameters in your configuration file before the first installation.

Network Parameter Default

Pod network

cluster_cidr

10.42.0.0/16

Service network

service_cidr

10.43.0.0/16

Cluster DNS service

cluster_dns

10.43.0.10

Important: You cannot change these ranges on an existing cluster. If you change them in the configuration file of a running cluster, the installer stops with the error cannot change CIDR/DNS on existing working RKE2 cluster.

Debug NodePorts (Not for Production)

Important: Do not use this option in production. It gives direct network access to internal services, such as MongoDB, ZooKeeper, and RabbitMQ.

For troubleshooting, you can expose internal Sisense services on NodePorts by setting expose_nodeports: true in the installer configuration (or global.exposeNodePorts.enabled: true in the Helm chart). When this option is enabled, the following ports are opened on every node:

  • All deployments: 30017 (MongoDB), 32181 (ZooKeeper), 30672 and 30673 (RabbitMQ).

  • Single-node deployments only: application and debug ports of the Sisense services, including 30082 and 30092 (management), 30084 and 30094 (query), 30086 and 30096 (build), 30555 (connectors), and 30870 and 30022 (translation).

Cluster Shared File System Implementation

Depending on which you use, the following ports should be opened:

FSx

Ports Description
TCP 988 Lustre (Amazon FSx for Lustre)

NFS

Allow outbound NFS traffic from the nodes to the NFS server.

Ports Description
TCP 2049 NFS

Load Balancer

If you are using an external load balancer, make sure that the load balancer supports WebSockets.

If you are using Amazon AWS with load balancing, ALB supports WebSockets, ELB does not.

Note:

The Classic Load Balancer in AWS does not support WebSockets.


Next Steps