Network Ports

2.7.1 Network Ports

This page lists all TCP/UDP ports that must be reachable between the components of a replication-manager deployment. Use it to configure firewall rules, security groups, and network policies.

2.7.2 replication-manager API and Dashboard

These ports are opened by the replication-manager process itself.

For deployments where replication-manager binds port 443 directly, the --user privilege-drop option is required (see Security Configuration Guide).

2.7.3 Database Servers

Add this to my.cnf on every monitored server to enable the extra port:

[mysqld]
extra_port = 3307
extra_max_connections = 10

Then set the corresponding parameter in replication-manager.toml:

db-servers-connect-timeout = 5
# replication-manager will try the extra port automatically when the main port is saturated

2.7.4 replication-manager SST / Backup Streaming

replication-manager implements its own State Snapshot Transfer (SST) mechanism for reseeding crashed or new replica nodes — separate from Galera SST. This uses a socat-based streaming pipeline:

1. replication-manager writes a job into the replication_manager_schema.jobs table on the donor node
2. The donor cron script streams the backup (mariabackup/xtrabackup xbstream) via socat back to replication-manager
3. replication-manager opens a TCP listener on the repman host to receive the stream
4. The joiner node (receiver) listens on port 4444 by default

Firewall recommendation: If you cannot allow all ephemeral TCP ports from DB hosts to the replication-manager host, pin the receiver port pool with:

scheduler-db-servers-sender-ports = "4000,4001,4002,4003"

This restricts the ports replication-manager opens for incoming backup streams to the declared list, allowing precise firewall rules. Without this parameter, replication-manager picks any available port on the host — you must then allow all high TCP ports (1024–65535) from DB hosts to the repman host, or use a permissive security group between repman and DB hosts.

2.7.5 Proxies

HAProxy

ProxySQL

MaxScale

2.7.6 Embedded Graphite Metrics

replication-manager ships an embedded Graphite/Carbon store. Since v3.1.1 the render API is proxied through the HTTPS API (port 10005) so none of these ports need to be opened externally unless you are connecting a Grafana instance directly to the Carbon API.

2.7.7 Multi-Node replication-manager (Arbitration)

When running multiple replication-manager instances for arbitration or HA:

2.7.8 SSH Bastion (On-Premise)

When the HTTPS terminal bastion feature is enabled (terminal-session-enabled = true) and onpremise-ssh = true, replication-manager opens back-end SSH connections from the repman host to each database/proxy host. The operator's browser only needs access to the HTTPS API port.

2.7.9 Summary — Inbound Rules per Host

replication-manager host

Database hosts

Proxy hosts (HAProxy / ProxySQL / MaxScale)

2.7.10 Outbound Firewall Rules for Registration

When cloud18 = true, replication-manager needs outbound HTTPS access to Signal18 cloud services for registration, SSO, config sync, plugin updates, and alert forwarding.

Cloudflare IPs: gitlab.signal18.io and s3.signal18.io are behind Cloudflare. Their IP addresses may change. Prefer FQDN-based firewall rules when possible, or allow the Cloudflare IP ranges from https://www.cloudflare.com/ips/.

All traffic is outbound from the repman host — no inbound ports need to be opened for Cloud18. See Network Traffic for the full flow details.