Create a gist now

Instantly share code, notes, and snippets.

Embed
Docker Swarm Port Requirements, both Swarm Mode 1.12+ and Swarm Classic, plus AWS Security Group Style Tables

Docker Swarm Mode Ports

Starting with 1.12 in July 2016, Docker Swarm Mode is a built-in solution with built-in key/value store. Easier to get started, and fewer ports to configure.

Inbound Traffic for Swarm Management

  • TCP port 2377 for cluster management & raft sync communications
  • TCP and UDP port 7946 for "control plane" gossip discovery communication between all nodes
  • UDP port 4789 for "data plane" VXLAN overlay network traffic
  • IP Protocol 50 (ESP) if you plan on using overlay network with the encryption option

AWS Security Group Example

AWS Tip: You should use Security Groups in AWS's "source" field rather then subnets, so SG's will all dynamically update when new nodes are added.

Inbound to Swarm Managers (superset of worker ports)

Type Protocol Ports Source
Custom TCP Rule TCP 2377 swarm + remote mgmt
Custom TCP Rule TCP 7946 swarm
Custom UDP Rule UDP 7946 swarm
Custom UDP Rule UDP 4789 swarm
Custom UDP Rule UDP 4789 swarm
Custom Protocol 50 all swarm

Inbound to Swarm Workers

Type Protocol Ports Source
Custom TCP Rule TCP 7946 swarm
Custom UDP Rule UDP 7946 swarm
Custom UDP Rule UDP 4789 swarm
Custom Protocol 50 all swarm

Docker Swarm "Classic" Ports, with Consul

For Docker 1.11 and older. I Used this list from Docker Docs on Swarm Classic, then tested on multiple swarms.

Inbound to Swarm Nodes

  • 2375 TCP for swarm manger -> nodes (LOCK PORT DOWN, no auth)
  • 7946 TCP/UDP for container network discovery from other swarm nodes
  • 4789 UDP container overlay network from other swarm nodes

Inbound to Swarm Managers

  • 3375 TCP for spawner -> swarm manager (LOCK PORT DOWN, no auth)

Inbound to Consul

  • 8500 TCP for swarm manager/nodes -> consul server (LOCK PORT DOWN, no auth)
  • 8300 TCP for consul agent -> consul server
  • 8301 TCP/UDP for consul agent -> consul agent
  • 8302 TCP/UDP for consul server -> consul server

Swarm Classic Inbound Ports In AWS Security Group Format, with Consul

AWS Tip: You should use Security Groups in AWS's "source" field rather then subnets, so SG's will all dynamically update when new nodes are added.

This is another way to look at the above lists, in a format that makes sense for AWS SG's

  • assume AWS inbound from:
    • Internet ELB -> Swarm Managers
    • Swarm Managers -> Swarm Nodes
    • Swarm Managers -> Consul Internal ELB
    • Swarm Nodes -> Consul Internal ELB
    • Consul Internal ELB -> Consul Nodes

ELB Swarm Manager

Type Protocol Ports Source
Custom TCP Rule TCP 3375 spawners

Swarm Managers

Type Protocol Ports Source
Custom TCP Rule TCP 3375 elb-swarm-manager

Swarm Nodes

Type Protocol Ports Source
Custom TCP Rule TCP 2375 swarm-managers
Custom TCP Rule TCP 7946 swarm-nodes
Custom UDP Rule UDP 7946 swarm-nodes
Custom UDP Rule UDP 4789 swarm-nodes

ELB Consul

Type Protocol Ports Source
Custom TCP Rule TCP 8500 swarm-nodes
Custom TCP Rule TCP 8500 swarm-managers

Consul Nodes

Type Protocol Ports Source
Custom TCP Rule TCP 8500 elb-consul
Custom TCP Rule TCP 8300-8302 consul-nodes
Custom UDP Rule UDP 8301-8302 consul-nodes
@domdorn

This comment has been minimized.

Show comment
Hide comment
@domdorn

domdorn Dec 17, 2016

awesome writeup, thanks!

domdorn commented Dec 17, 2016

awesome writeup, thanks!

@jgwerner

This comment has been minimized.

Show comment
Hide comment
@jgwerner

jgwerner Feb 2, 2017

Thank you!!!

jgwerner commented Feb 2, 2017

Thank you!!!

@basetdd2416

This comment has been minimized.

Show comment
Hide comment
@basetdd2416

basetdd2416 Aug 9, 2017

Thanks

Thanks

@mcpherson

This comment has been minimized.

Show comment
Hide comment
@mcpherson

mcpherson Aug 14, 2017

Nice! Thanks.

Nice! Thanks.

@dimpiax

This comment has been minimized.

Show comment
Hide comment
@dimpiax

dimpiax Oct 26, 2017

Appreciate this share!

dimpiax commented Oct 26, 2017

Appreciate this share!

@korobitsin

This comment has been minimized.

Show comment
Hide comment
@korobitsin

korobitsin Dec 28, 2017

Great summary, thank you!
But please note that for encrypted overlay networks you need allow Inbound Protocol 50 (ESP) (using "Custom Protocol" in AWS) to Swarm Workers

Great summary, thank you!
But please note that for encrypted overlay networks you need allow Inbound Protocol 50 (ESP) (using "Custom Protocol" in AWS) to Swarm Workers

@renatojava

This comment has been minimized.

Show comment
Hide comment
@renatojava

renatojava Jun 12, 2018

Who is Source -> "Swarm" ? My own security group swarm that I am configuring?

Who is Source -> "Swarm" ? My own security group swarm that I am configuring?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment