# Network ports and endpoints > Every port the hub, the edge gateways and the services of the Docker installation listen on, and the HTTP endpoints behind them. Source: https://proxus.io/docs/reference/ports This page lists what each part of a Proxus installation listens on, with the default port from the configuration file and the delivered Docker Compose file. Use it to write firewall rules. Which of these must be reachable from outside the host is in [Security hardening](https://proxus.io/docs/operate/security). ## Hub | Port | Protocol | Setting | Used by | | --- | --- | --- | --- | | 8443 | HTTPS | `[Service] UI-HTTPS-Port` | Browsers, API clients, MCP clients, gateway installation. On by default; an empty value turns it off. | | 8080 | HTTP | `[Service] UI-Port` | The same, unencrypted, for local access. `[Service] RedirectHttpToHttps = "true"` sends it to HTTPS. | | 4222 | NATS over TLS | `[NATS] BrokerUrl` | The hub's own processes and the **SYSTEM** gateway. | | 7422 | NATS over TLS | | Edge gateways on other machines. | | 6222 | NATS over TLS | | Kubernetes HA only: the NATS servers of the cluster connect to each other by pod name. | | 8222 | HTTP | | NATS monitoring. Internal. | The NATS ports belong to the hub's message server (`hub-server`). Every NATS connection checks the server's certificate against the platform CA. See [Certificates](https://proxus.io/docs/administer/certificates). Endpoints on the hub's HTTP and HTTPS ports: | Path | What it is | Sign-in | | --- | --- | --- | | `/` | The hub's screens. | user | | `/api/Authentication/Authenticate` | Gets a token. See [REST API](https://proxus.io/docs/develop/rest-api). | none | | `/api/odata/...` | Read and change objects. | token or browser session | | `/api/Telemetry/execute` | Query stored values. See [Telemetry API](https://proxus.io/docs/develop/telemetry-api). | token | | `/swagger` | The interactive API description; `/swagger/v1/swagger.json` is the OpenAPI file. | none to view | | `/mcp` | The MCP server for AI assistants. See [MCP server](https://proxus.io/docs/develop/mcp). | sign-in inside MCP | | `/edge/` | The install script of a new gateway, valid once and for one hour. See [Install a gateway](https://proxus.io/docs/connect/edge-gateways/install-a-gateway). | the token in the address | | `/edge/uninstall/` | The removal script of a gateway. | none | | `/healthz` | Answers `Healthy` when the hub is running. For load balancers and container health checks. | none | | `/metrics` | Metrics for Prometheus, only when `[Metrics] Enable` or `[Tracing] Enable` is `true`. | none | ## Edge gateway Every gateway, including the hub's own **SYSTEM** gateway, listens on: | Port | Protocol | Setting | Used by | | --- | --- | --- | --- | | 8883 | MQTT over TLS | `[MQTTBroker] TlsPort` | UNS subscribers and devices that publish their own values, encrypted with the gateway's certificate. Opens once the hub has issued the certificate. `0` turns it off. See [MQTT and the UNS topics](https://proxus.io/docs/develop/mqtt). | | 1883 | MQTT | `[MQTTBroker] MQTTBrokerPort` | The same, without TLS, for devices that cannot use it. `[MQTTBroker] PlainEnabled = false` closes it. | | 8083 | HTTP | `[Service] Server-Port` | Health checks and historical import. | | not set | HTTPS | `[Service] Server-HTTPS-Port` | The same, encrypted with the gateway's certificate from the hub, when you set a port. | Endpoints on the gateway's HTTP port: | Path | What it is | Sign-in | | --- | --- | --- | | `/healthz` | Answers `Healthy` when the gateway is running. | none | | `/api/v1/devices//historical/batches` | Historical import. See [Historical import](https://proxus.io/docs/develop/historical-import). | the device's token in `X-IoT-Token` | | `/metrics` | Metrics for Prometheus, only when `[Metrics] Enable` or `[Tracing] Enable` is `true`. | none | A gateway opens connections itself: to the hub's NATS server over TLS (a gateway installed from the hub uses the leaf port 7422; the hub's own gateway uses 4222), to the hub on 8443 during installation, to the devices it reads, and to its outbound targets. Devices and targets do not connect to the gateway, except devices that publish to its broker. A gateway installed from the hub publishes 8883, 1883 and its service port (8083) on its host. ## Services in the Docker installation The delivered `docker-compose.yml` publishes these ports on the host: | Container | Port on the host | What it is | | --- | --- | --- | | `proxus-ui` | 8080, 8443 | The hub, over HTTP and HTTPS. | | `proxus-server` | 8083, 1883, 8883 | The hub's gateway (**SYSTEM**): HTTP, MQTT and MQTT over TLS. | | `hub-server` | 4222 | NATS over TLS, the message bus between the hub and its own gateway. | | `hub-server` | 7422 | NATS leaf connections over TLS: gateways on other machines connect here. | | `hub-server` | 8222 | NATS monitoring page (HTTP). | | `postgresql` | 5442 | PostgreSQL, the configuration database. | | `clickhouse` | 8123 | ClickHouse over HTTP, the database of tag values and logs. | | `clickhouse` | 9000 | ClickHouse native protocol. | | `clickhouse` | 9004 | ClickHouse MySQL-compatible protocol, used by reports. | | `clickhouse` | 9005 | ClickHouse PostgreSQL-compatible protocol. | > **Warning:** Only 8443 has to be reachable by users, and 7422 and 8443 by gateways on other machines. Keep the database ports (5442, 8123, 9000, 9004, 9005), 4222 and 8222 closed to everything but the host, or remove them from the compose file if nothing outside the host needs them. ## Ports the gateway connects to When you leave **Port** empty on a device, the gateway uses the protocol's usual port, for example 502 for Modbus TCP, 102 for Siemens S7 and 44818 for EtherNet/IP. The full list is in [Protocols](https://proxus.io/docs/reference/protocols). ## Related - [Configuration keys](https://proxus.io/docs/reference/configuration) - [Docker](https://proxus.io/docs/operate/docker) - [Security hardening](https://proxus.io/docs/operate/security)