Ports
Every port Failover LB uses, what it carries, and who should be able to reach it.
The full list
| Port | Protocol | What it is | Who should reach it |
|---|---|---|---|
80 | TCP | Web traffic and certificate validation | Everyone |
443 | TCP and UDP | Secure web traffic. UDP as well if you use HTTP/3 | Everyone |
7443 | TCP | The management screen | Your office networks only |
7444 | TCP | Node to node | The other nodes only |
7081 | TCP | stub_status for the dashboard | Nobody. It is bound to localhost |
53 | TCP and UDP | DNS failover answers | Everyone, if you use it |
5353 | TCP and UDP | Where the DNS part really listens | Nobody directly |
51820 | UDP | The tunnel, if you use it | Your tunneled workloads, outbound to here |
Why there are two DNS ports
The part that answers DNS lookups runs without root on purpose, and a program without root cannot bind port 53. So it listens on 5353 instead, on UDP and TCP both, and a firewall rule the software manages sends UDP and TCP port 53 to it. Lookups arrive over UDP and fall back to TCP when the answer is too big for one packet, which is why both matter.
Never test against 5353
You will get an answer whether or not the public path works, which tells you nothing. Always test with no port on the end, because that is the path your visitors use.
Why 7444 is safe even when it is open
Three separate things have to line up on every peer call: a client certificate signed by this cluster's own authority and nothing else, a source address on the node roster, and an HMAC signature made with a key only that node holds. The timestamp and a nonce are inside the signed part, so a captured request cannot be replayed.
A browser hitting that port gets nowhere. Firewall it to your peers anyway, because reducing what is reachable is free.
The management port is the one to be careful with
NFM_ADMIN_ALLOWLIST is checked before the login page even renders, so a stolen
password from the wrong network gets nothing. Set it, on every node, and include IPv6 forms
if your staff might arrive over IPv6.
You can also bind the GUI to one interface only. If your management network is its own
network card, put that address in NFM_BIND_ADDRESS and cut the exposure
further.