The ports to open for a Monopam v2026.10 installation. Gateway listeners other than the main endpoint are off until you enable them; open only the ones you use.
Into Monopam (application)
Port | From | Purpose | Set by |
|---|---|---|---|
443 (80 redirects) | Users' browsers, gateways, agents, kubectl and MCP clients | Web interface, API and live-session channels | Your load balancer |
8080 | Load balancer | Application container |
|
Into a gateway
Port | From | Purpose | Set by |
|---|---|---|---|
Main endpoint (no fixed default) | Monopam application | Gateway API and sessions | Gateway |
4422 | Users' SSH clients | SSH bastion (off by default) | Gateway → SSH Bastion → Listen Port |
Your choice (0 = off) | SFTP and SCP clients | SSH bastion file transfer | SFTP/SCP Port |
6443 | kubectl and oc | Kubernetes listener (off by default) | Gateway configuration |
15432 | Database clients | Database Proxy: PostgreSQL | Gateway → Database |
13306 | Database clients | Database Proxy: MySQL and MariaDB | Gateway → Database |
11433 | Database clients | Database Proxy: MSSQL | Gateway → Database |
11521 | Database clients | Database Proxy: Oracle | Gateway → Database |
15062 | Database clients | Database Proxy: IBM Db2 | Gateway → Database |
15025 | Database clients | Database Proxy: Sybase ASE | Gateway → Database |
15039 | Database clients | Database Proxy: SAP HANA | Gateway → Database |
3389 | RDP desktop clients | Native RDP through a Windows gateway | System → Configurations → Gateway |
If you change a Database Proxy or Kubernetes port on a gateway, change the port Monopam advertises to users in the tenant configuration too, unless a load balancer maps the ports. The Database Proxy admin port is loopback only and needs no rule.
Out of a gateway
Port | To | Purpose |
|---|---|---|
443 (the Monopam address) | Monopam application | API calls, live channel, audit delivery, recording upload |
22 | Linux and network targets | SSH and SFTP sessions |
3389 | Windows targets | RDP sessions |
5900 (standard) | VNC targets | VNC sessions |
5985 / 5986 | Windows targets | WinRM, from Windows gateways (certificates, PowerShell) |
5432, 3306, 1433, 1521, 50000, 5000, 30015 | Database servers | The real database behind the Database Proxy (the resource's port) |
The cluster's API port (usually 6443) | Kubernetes API servers | Kubernetes access |
4482 | Endpoint agents | Older inbound agent listener, used only as a fallback |
Out of the application
Port | To | Purpose |
|---|---|---|
5432 or 1433 | Application database | PostgreSQL or SQL Server |
6379 | Redis | Cache, session transport, job queue |
Object storage port (for example 9000) | S3-compatible storage | Recordings and files (gateways use it too) |
443 | Monosign | Sign-in and identity |
389 (StartTLS) / 636 (LDAPS) | Domain controllers | AD Bridging and privileged account discovery |
Your SMTP port | Mail relay | Email notifications |
Out of endpoints
Port | To | Purpose |
|---|---|---|
443 | Monopam application | Agent channel (main transport for agents) |
Browser sessions (RDP, SSH, VNC in the browser) need no direct path from the user to the gateway; they travel through the Monopam address.