Network Requirements
| Port | Description | Purpose (Allow Through the Firewall as Needed) |
|---|---|---|
| 22 (TCP) | SSH node access | SSH access when adding or replacing nodes; administrator login for troubleshooting. |
| 2379, 2380 (TCP) | Embedded etcd | Cluster control plane data storage and inter-node communication. |
| 10250 (TCP) | Kubelet | Node management and status collection. |
| 8472 (UDP) | Flannel VXLAN | Communication between the cluster's Pod and Service network segments. |
| 30826 (TCP) | K3s API Server (actual control plane port, not 6443) | Core cluster communication and access for additional nodes. |
| 30827 (TCP) | K3s Supervisor | Reserved for cluster supervision. |
| 5001 (TCP) | P2P image distribution | Image distribution within the cluster during installation, upgrades, and Node Expansion. |
| 9100 (TCP) | Node Exporter | Node metrics collection. |
| 30815 (TCP) | Node Exporter (legacy) | Node metrics collection. |
| 22350 (TCP) | CodeMeter licensing | License checks from cluster nodes to the Authorization Node. |
| 30882 (TCP) | Admin Console MySQL | Management services on each node access the management database, primarily through the local loopback address. |
| 30090 (TCP) | Prometheus API | Metrics queries from the Admin Console. |
| 30816 (TCP) | RabbitMQ service | Access to the RabbitMQ service within the cluster. |
| 123 (UDP) | NTP time synchronization | Time synchronization between devices and nodes; node synchronization with upstream NTP servers (outbound). |
| 80, 443 (TCP) | DJI FlightHub 2 frontend/HTTPS entry point | Platform access from user browsers and devices. |
| 30812 (TCP) | DJI FlightHub 2 backend API | Dock and device APIs (legacy port retained). |
| 30888 (TCP) | Admin Console/Installation Wizard | Browser access to the Installation Wizard and Admin Console. |
| 30800 (TCP) | Operations and maintenance frontend | Entry point for the operations and maintenance platform. |
| 30801, 30802, 30804 (TCP) | MinIO console/object storage API/static resources | Object storage management and data access. |
| 30807, 30809 (TCP) | EMQX/RabbitMQ consoles | Messaging middleware management. |
| 30811 (TCP) | Grafana | Monitoring console. |
| 30813, 30814 (TCP) | Dock maps/map tiles | Map services. |
| 30820, 30821, 30822 (TCP) | Email SMTP/Submission/IMAP | Sending and receiving email through the platform's built-in email service. |
| 30823 (TCP) | VictoriaLogs log queries | Log query UI. |
| 30824, 30825 (TCP) | Task scheduling gateway/management | Asynchronous task scheduling. |
| 30829 (TCP) | Digital elevation | Elevation service. |
| 19090 (TCP) | Livestream monitoring | Livestream quality monitoring. |
| 30808 (TCP) | Aircraft control WebSocket | Device command channel initiated by the browser. |
| 1883, 8883 (TCP) | EMQX MQTT/MQTT-TLS | Device messaging connections. |
| 8443 (TCP) | DRTC device entry point | Device connections over HTTPS/mTLS. |
| 60002–60004 (TCP+UDP), 60006 (TCP), 60084 (UDP) | DRTC media channels | Device media transport/WSS/multiplexing/direct dump-data connections. |
| 38081 (TCP) | TAS API | Device connections (TAS platform). |
| 38080 (TCP) | Bridge API | Internal bridging (TAS platform). |
| 8090–8094, 8096, 8099 (TCP) | 4G relay/gateway | 4G Value-Added Services; aircraft access each port through a public IP address. |
| 31000–31099 (TCP) | LMC media signaling | WebRTC WHIP/WHEP signaling connections. |
| 31100–31199 (TCP+UDP) | LMC WebRTC | WebRTC media transport. |
| 31200–31299 (TCP) | LMC RTMP | Media streaming ingest. |
| 31300–31399 (TCP+UDP) | GB28181 SIP | GB28181 signaling. |
| 31400–32499 (UDP) | GB28181 media | GB28181 media transport. |
| 30854 (TCP) | live-stream-hub RTSP | Pulling livestreams through ports on the node's host. |
| 10000–10100 (UDP) | live-stream-hub RTP | Direct livestream media transport through ports on the node's host. |
| 2378 (TCP) | GPU Docker | Container interface on GPU nodes. |
| 30805 (TCP) | Terra Rescon | Reconstruction service entry point. |
| 30817–30819 (TCP) | Terra GPU metrics | Metrics reporting from GPU nodes. |
| 53 (UDP+TCP, outbound) | DNS resolution | Cluster resolution of external domain names (external SMTP/LLM/map data sources, etc.). |
| 443 (TCP, outbound) | Image registry/object storage/UOM platform | Image downloads (pull mode), map data imports, and remote identification reporting. |
| 25/465/587 (TCP, outbound) | External SMTP relay | Sending platform email through an external service. |
| 3260, 2049, 445 (TCP, outbound) | External iSCSI/NFS/SMB storage | Used when switching the storage backend to external storage. |
| 22350 (TCP, outbound) | External Authorization Server | Network licensing through an external CmWAN/Authorization Server. |
| 8080 and others (TCP, outbound; ports depend on configuration) | LLM inference service | Access to an external multimodal large language model inference service at the address specified by LLM_BASE_URL. |
Allow the relevant ports through the firewall based on the deployment scenario and the features enabled. Ports marked "outbound" in the table are used by servers to access external services. Destination addresses and ports depend on the actual configuration.