Firewall Requirements

Several components in the Stellar Cyber product require certain ports and domains be accessible through your firewall. Use the legend and tables below to understand which are appropriate for your environment.

Legend

CM: Configuration Manager (runs in the DL)
DA: Data Analyzer*
DL: Data Lake*
DP: Data Processor

^{*Although these are part of the DP, they have unique IP addresses so are listed independently in the tables below.}

Ports for Associated Stellar Cyber VMs

When configuring the DP with separate VMs for the DL and DA (or in a cluster with additional worker nodes), all nodes must be in the same VPC, VCN, or VNET, and all ports between the nodes must be open in your firewall.

Open All TCP Ports Between Internal Addresses of Associated Stellar Cyber VMs

All TCP ports must be open between the internal network addresses of associated Stellar Cyber VMs, either in a cluster or a standard deployment with separate DL-m and DA-m VMs. For example, in a standard deployment with the DL-m on 172.31.7.0/24 and the DA-m on 172.31.10.0/24, the following rules must exist:

The DL-m must have a rule that allows all inbound TCP traffic from the 172.31.10.0/24 subnet.
The DA-m must have a rule that allows all inbound TCP traffic from the 172.31.7.0/24 subnet.

Stellar Cyber recommends that you add a firewall rule to allow all for clustered VMs (or just the DA and DL VMs in a standard deployment) and set the priority of that rule higher than the standard rule for the VPC, VCN, or VNET,.

General Purpose Ports

Source	Destination	Port	Protocol	Required?	Purpose
Stellar Cyber user's SSH client	DL, DA, LAS, NS, SS, MS	DL, DA	22	TCP	Optional	Management access
DL, DA, Sensors	DL, DA	DNS Server Environment specific	53	UDP	Required	Name service for: Downloading third-party libraries Support of customer configured Active Directory CM communication (if CM is by name vs IP)
DL, DA, All sensors	DL, DA	NTP Server	123	UDP	Required	Performing time synchronization
Stellar Cyber user's web browser	DL	443	TCP	Required	Viewing the Stellar Cyber user interface

Domains

All of the following domains are required.

Source	Destination	Port	Protocol	Purpose
DL, DA	privateregistry.stellarcyber.ai (previously 50.220.129.169)	443	TCP	Private docker registry server for software updates Note: Because there are numerous stellarcyber.ai subdomains, you may find it simpler to open *.stellarcyber.ai.
DL, DA	acps.stellarcyber.ai	443	TCP	Downloading software installers/metarepo, IOC feed, IDS signature update and license validation
Stellar Cyber user's web browser	doc-server.stellarcyber.ai	443	TCP	Accessing online help on the Stellar Cyber documentation server
DL, DA	docker.com, .docker.com, docker.io, .docker.io quay.io, *.quay.io ghcr.io	443	TCP	Software updates . As indicated, also include all subdomains of docker.com and docker.io. If the private registry is enabled, then this domain is optional
DL, DA	k8s.gcr.io, registry.k8s.io *.pkg.dev pkgs.k8s.io, prod-cdn.packages.k8s.io dl.k8s.io prod-registry-k8s-io-eu-central-1.s3.dualstack.eu-central-1.amazonaws.com	443	TCP	Downloading updated container images from the Kubernetes registry. The k8s.gcr.io domain is the legacy registry and is migrating to registry.k8s.io in Kubernetes 1.25. The *.pkg.dev domain and the Amazon S3 host are redirect targets of registry.k8s.io. The upstream registry selects a backend based on the location of the client — the S3 host listed here was observed serving clients in the EU — so the set of hosts a given Stellar Cyber deployment contacts varies and is not exhaustive. If your egress policy cannot accommodate this, mirror the release images to a private registry instead. The pkgs.k8s.io and dl.k8s.io domains host the Kubernetes package repositories and release binaries. Requests to pkgs.k8s.io are redirected to prod-cdn.packages.k8s.io, so both must be reachable.
DL, DA	https://sdk-ld.stellarcyber.ai https://stream-ld.stellarcyber.ai https://clientsdk-ld.stellarcyber.ai https://clientsdk.launchdarkly.com https://clientstream-ld.stellarcyber.ai https://clientstream.launchdarkly.com https://events-ld.stellarcyber.ai https://events.launchdarkly.com	443	TCP	Retrieve feature configuration information used to control the availability of product functionality.
DL, DA	map.google.com map.baidu.com jsuites.net userpilot.io fonts.gstatic.com fonts.googleapis.com bossanove.uk api-js.mixpanel.com launchdarkly.com	443	TCP	Miscellaneous UI support, including font rendering, product walkthroughs, and maps.
Stellar Cyber user's web browser	https://app.launchdarkly.com https://clientstream.launchdarkly.com https://events.launchdarkly.com https://clientsdk-ld.stellarcyber.ai https://clientstream-ld.stellarcyber.ai https://events-ld.stellarcyber.ai	443	TCP	Dynamically enabling Early Access Program functionality, features, and fixes in the Stellar Cyber Platform
Machine with User's Browser	*.oraclecloud.com	443	TCP	For download of upgrade packages from Oracle Cloud Infrastructure.

After completing the required deployment steps and logging in to the Stellar Cyber Platform, select Help > Knowledge Base Home to continue administrative and data collection setup in the full Knowledge Base.