Reference · for Administrators, Developers
Network ports and endpoints
Every port the hub, the edge gateways and the services of the Docker installation listen on, and the HTTP endpoints behind them.
This page lists what each part of a Proxus installation listens on, with the default port from the configuration file and the delivered Docker Compose file. Use it to write firewall rules. Which of these must be reachable from outside the host is in Security hardening.
Hub
| Port | Protocol | Setting | Used by |
|---|---|---|---|
| 8443 | HTTPS | [Service] UI-HTTPS-Port | Browsers, API clients, MCP clients, gateway installation. On by default; an empty value turns it off. |
| 8080 | HTTP | [Service] UI-Port | The same, unencrypted, for local access. [Service] RedirectHttpToHttps = "true" sends it to HTTPS. |
| 4222 | NATS over TLS | [NATS] BrokerUrl | The hub's own processes and the SYSTEM gateway. |
| 7422 | NATS over TLS | Edge gateways on other machines. | |
| 6222 | NATS over TLS | Kubernetes HA only: the NATS servers of the cluster connect to each other by pod name. | |
| 8222 | HTTP | NATS monitoring. Internal. |
The NATS ports belong to the hub's message server (hub-server). Every NATS connection checks the server's certificate against the platform CA. See Certificates.
Endpoints on the hub's HTTP and HTTPS ports:
| Path | What it is | Sign-in |
|---|---|---|
/ | The hub's screens. | user |
/api/Authentication/Authenticate | Gets a token. See REST API. | none |
/api/odata/... | Read and change objects. | token or browser session |
/api/Telemetry/execute | Query stored values. See Telemetry API. | token |
/swagger | The interactive API description; /swagger/v1/swagger.json is the OpenAPI file. | none to view |
/mcp | The MCP server for AI assistants. See MCP server. | sign-in inside MCP |
/edge/<token> | The install script of a new gateway, valid once and for one hour. See Install a gateway. | the token in the address |
/edge/uninstall/<gateway ID> | The removal script of a gateway. | none |
/healthz | Answers Healthy when the hub is running. For load balancers and container health checks. | none |
/metrics | Metrics for Prometheus, only when [Metrics] Enable or [Tracing] Enable is true. | none |
Edge gateway
Every gateway, including the hub's own SYSTEM gateway, listens on:
| Port | Protocol | Setting | Used by |
|---|---|---|---|
| 8883 | MQTT over TLS | [MQTTBroker] TlsPort | UNS subscribers and devices that publish their own values, encrypted with the gateway's certificate. Opens once the hub has issued the certificate. 0 turns it off. See MQTT and the UNS topics. |
| 1883 | MQTT | [MQTTBroker] MQTTBrokerPort | The same, without TLS, for devices that cannot use it. [MQTTBroker] PlainEnabled = false closes it. |
| 8083 | HTTP | [Service] Server-Port | Health checks and historical import. |
| not set | HTTPS | [Service] Server-HTTPS-Port | The same, encrypted with the gateway's certificate from the hub, when you set a port. |
Endpoints on the gateway's HTTP port:
| Path | What it is | Sign-in |
|---|---|---|
/healthz | Answers Healthy when the gateway is running. | none |
/api/v1/devices/<ID>/historical/batches | Historical import. See Historical import. | the device's token in X-IoT-Token |
/metrics | Metrics for Prometheus, only when [Metrics] Enable or [Tracing] Enable is true. | none |
A gateway opens connections itself: to the hub's NATS server over TLS (a gateway installed from the hub uses the leaf port 7422; the hub's own gateway uses 4222), to the hub on 8443 during installation, to the devices it reads, and to its outbound targets. Devices and targets do not connect to the gateway, except devices that publish to its broker. A gateway installed from the hub publishes 8883, 1883 and its service port (8083) on its host.
Services in the Docker installation
The delivered docker-compose.yml publishes these ports on the host:
| Container | Port on the host | What it is |
|---|---|---|
proxus-ui | 8080, 8443 | The hub, over HTTP and HTTPS. |
proxus-server | 8083, 1883, 8883 | The hub's gateway (SYSTEM): HTTP, MQTT and MQTT over TLS. |
hub-server | 4222 | NATS over TLS, the message bus between the hub and its own gateway. |
hub-server | 7422 | NATS leaf connections over TLS: gateways on other machines connect here. |
hub-server | 8222 | NATS monitoring page (HTTP). |
postgresql | 5442 | PostgreSQL, the configuration database. |
clickhouse | 8123 | ClickHouse over HTTP, the database of tag values and logs. |
clickhouse | 9000 | ClickHouse native protocol. |
clickhouse | 9004 | ClickHouse MySQL-compatible protocol, used by reports. |
clickhouse | 9005 | ClickHouse PostgreSQL-compatible protocol. |
Ports the gateway connects to
When you leave Port empty on a device, the gateway uses the protocol's usual port, for example 502 for Modbus TCP, 102 for Siemens S7 and 44818 for EtherNet/IP. The full list is in Protocols.
Related
Was this page helpful?
Evaluating Proxus? See it on your own machines in a 30-minute technical session.