Rancher nodes:
Nodes running the rancher/rancher container

Rancher nodes - Inbound rules
Protocol Port Source Description
TCP 80
  • Load balancer/proxy that does external SSL termination
Rancher UI/API when external SSL termination is used
TCP 443
  • etcd nodes
  • controlplane nodes
  • worker nodes
  • Hosted/Imported Kubernetes
  • any that needs to be able to use UI/API
Rancher agent, Rancher UI/API, kubectl
Rancher nodes - Outbound rules
Protocol Port Destination Description
TCP 22
  • Any node IP from a node created using Node Driver
SSH provisioning of nodes using Node Driver
TCP 443
  • 35.160.43.145/32
  • 35.167.242.46/32
  • 52.33.59.17/32
git.rancher.io (catalogs)
TCP 6443
  • Hosted/Imported Kubernetes API
Kubernetes apiserver

etcd nodes:
Nodes with the role etcd

etcd nodes - Inbound rules
Protocol Port Source Description
TCP 2379
  • etcd nodes
  • controlplane nodes
etcd client requests
TCP 2380
  • etcd nodes
  • controlplane nodes
etcd peer communication
UDP 8472
  • etcd nodes
  • controlplane nodes
  • worker nodes
Canal/Flannel VXLAN overlay networking
TCP 10250
  • controlplane nodes
kubelet
etcd nodes - Outbound rules
Protocol Port Destination Description
TCP 443
  • Rancher nodes
Rancher agent
TCP 2379
  • etcd nodes
etcd client requests
TCP 2380
  • etcd nodes
etcd peer communication
TCP 6443
  • controlplane nodes
Kubernetes apiserver
UDP 8472
  • etcd nodes
  • controlplane nodes
  • worker nodes
Canal/Flannel VXLAN overlay networking

controlplane nodes:
Nodes with the role controlplane

controlplane nodes - Inbound rules
Protocol Port Source Description
TCP 80
  • Any that consumes Ingress services
Ingress controller (HTTP)
TCP 443
  • Any that consumes Ingress services
Ingress controller (HTTPS)
TCP 6443
  • etcd nodes
  • controlplane nodes
  • worker nodes
Kubernetes apiserver
UDP 8472
  • etcd nodes
  • controlplane nodes
  • worker nodes
Canal/Flannel VXLAN overlay networking
TCP 10250
  • controlplane nodes
kubelet
TCP/UDP 30000-32767
  • Any source that consumes NodePort services
NodePort port range
controlplane nodes - Outbound rules
Protocol Port Destination Description
TCP 443
  • Rancher nodes
Rancher agent
TCP 2379
  • etcd nodes
etcd client requests
TCP 2380
  • etcd nodes
etcd peer communication
UDP 8472
  • etcd nodes
  • controlplane nodes
  • worker nodes
Canal/Flannel VXLAN overlay networking
TCP 10250
  • etcd nodes
  • controlplane nodes
  • worker nodes
kubelet

worker nodes:
Nodes with the role worker

worker nodes - Inbound rules
Protocol Port Source Description
TCP 80
  • Any that consumes Ingress services
Ingress controller (HTTP)
TCP 443
  • Any that consumes Ingress services
Ingress controller (HTTPS)
UDP 8472
  • etcd nodes
  • controlplane nodes
  • worker nodes
Canal/Flannel VXLAN overlay networking
TCP 10250
  • controlplane nodes
kubelet
TCP/UDP 30000-32767
  • Any source that consumes NodePort services
NodePort port range
worker nodes - Outbound rules
Protocol Port Destination Description
TCP 443
  • Rancher nodes
Rancher agent
TCP 6443
  • controlplane nodes
Kubernetes apiserver
UDP 8472
  • etcd nodes
  • controlplane nodes
  • worker nodes
Canal/Flannel VXLAN overlay networking