The ports to open for a Monopam v2026.10 installation. Gateway listeners other than the main endpoint are off until you enable them; open only the ones you use.
Into Monopam (application)
|
Port |
From |
Purpose |
Set by |
|---|---|---|---|
|
443 (80 redirects) |
Users' browsers, gateways, agents, kubectl and MCP clients |
Web interface, API and live-session channels |
Your load balancer |
|
8080 |
Load balancer |
Application container |
|
Into a gateway
|
Port |
From |
Purpose |
Set by |
|---|---|---|---|
|
Main endpoint (no fixed default) |
Monopam application |
Gateway API and sessions |
Gateway |
|
4422 |
Users' SSH clients |
SSH bastion (off by default) |
Gateway → SSH Bastion → Listen Port |
|
Your choice (0 = off) |
SFTP and SCP clients |
SSH bastion file transfer |
SFTP/SCP Port |
|
6443 |
kubectl and oc |
Kubernetes listener (off by default) |
Gateway configuration |
|
15432 |
Database clients |
Database Proxy: PostgreSQL |
Gateway → Database |
|
13306 |
Database clients |
Database Proxy: MySQL and MariaDB |
Gateway → Database |
|
11433 |
Database clients |
Database Proxy: MSSQL |
Gateway → Database |
|
11521 |
Database clients |
Database Proxy: Oracle |
Gateway → Database |
|
15062 |
Database clients |
Database Proxy: IBM Db2 |
Gateway → Database |
|
15025 |
Database clients |
Database Proxy: Sybase ASE |
Gateway → Database |
|
15039 |
Database clients |
Database Proxy: SAP HANA |
Gateway → Database |
|
3389 |
RDP desktop clients |
Native RDP through a Windows gateway |
System → Configurations → Gateway |
If you change a Database Proxy or Kubernetes port on a gateway, change the port Monopam advertises to users in the tenant configuration too, unless a load balancer maps the ports. The Database Proxy admin port is loopback only and needs no rule.
Out of a gateway
|
Port |
To |
Purpose |
|---|---|---|
|
443 (the Monopam address) |
Monopam application |
API calls, live channel, audit delivery, recording upload |
|
22 |
Linux and network targets |
SSH and SFTP sessions |
|
3389 |
Windows targets |
RDP sessions |
|
5900 (standard) |
VNC targets |
VNC sessions |
|
5985 / 5986 |
Windows targets |
WinRM, from Windows gateways (certificates, PowerShell) |
|
5432, 3306, 1433, 1521, 50000, 5000, 30015 |
Database servers |
The real database behind the Database Proxy (the resource's port) |
|
The cluster's API port (usually 6443) |
Kubernetes API servers |
Kubernetes access |
|
4482 |
Endpoint agents |
Older inbound agent listener, used only as a fallback |
Out of the application
|
Port |
To |
Purpose |
|---|---|---|
|
5432 or 1433 |
Application database |
PostgreSQL or SQL Server |
|
6379 |
Redis |
Cache, session transport, job queue |
|
Object storage port (for example 9000) |
S3-compatible storage |
Recordings and files (gateways use it too) |
|
443 |
Monosign |
Sign-in and identity |
|
389 (StartTLS) / 636 (LDAPS) |
Domain controllers |
AD Bridging and privileged account discovery |
|
Your SMTP port |
Mail relay |
Email notifications |
Out of endpoints
|
Port |
To |
Purpose |
|---|---|---|
|
443 |
Monopam application |
Agent channel (main transport for agents) |
Browser sessions (RDP, SSH, VNC in the browser) need no direct path from the user to the gateway; they travel through the Monopam address.