Configuring network requirements

4 minute read

CloudBees CI’s components (the Client Master and operations center server) run services that require network communication over several configurable ports. You should open ports according to the services you plan to use.

Defining Inbound (Listening) Ports

Each CloudBees CI component listens for connections on the ports listed below. Many of these ports are used for optional services and can be disabled or enabled according to your needs.

Default PortExample Port 1ServiceConfigureDescriptionReference

8080

80

HTTP

Specify the command line option
--httpPort=$HTTP_PORT, where $HTTP_PORT is the new value of this HTTP listening port.
(Specify the value -1 to disable this port.)

When leveraging the built-in Jetty servlet container, a CloudBees CI component defaults to listening on port 8080 for the component’s web application.

Starting and Accessing Jenkins from jenkins-ci.org

Disabled

443

HTTPS

Specify the command line option
--httpsPort=$HTTP_PORT, where $HTTP_PORT is the new value of this HTTPS listening port.
(Specify the value -1 to disable this port.)

When leveraging the built-in servlet container, a CloudBees CI component can optionally respond over HTTPS.

Starting and Accessing Jenkins from jenkins-ci.org

Disabled or
50000

50000

JNLP

In the CloudBees CI component UI, navigate to:
Manage Jenkins Configure Global SecurityTCP port for JNLP agents

A CloudBees CI component exposes a port for agents to connect via the Java Network Launch Protocol (JNLP). It is also the primary port used by the Jenkins CLI.

operations center uses this port for Client Master connectivity.

Distributed Builds from jenkins-ci.org

Random

2222

SSH

In the CloudBees CI component UI, navigate to:
Manage Jenkins Configure SystemSSH ServerSSHD Port

A CloudBees CI component runs an SSH server, exposing a subset of CLI commands and allowing plugins to add functionality over SSH.

A CloudBees CI component optionally uses the SSH port for the Validated Merge plugin.

Jenkins SSH from jenkins-ci.org

33848/udp

UDP

Specify the command line option
-Dhudson.udp=$UDP_PORT, where $UDP_PORT is the new value of this UDP listening port.
(Specify the value -1 to disable this port.)

Allows a CloudBees CI component to be auto-discovered using UDP multicast.

Auto-discovering Jenkins on the network from jenkins-ci.org

5353

DNS

Specify the command line option
-Dhudson.DNSMultiCast.\disabled=true.

Allows a CloudBees CI component to be auto-discovered using DNS Multicast.

Auto-discovering Jenkins on the network from jenkins-ci.org

9200

HTTP

In the CloudBees CI component UI, navigate to:
Manage Jenkins Configure AnalyticsAnalyticsElasticsearch ConfigurationHTTP Port

operations center's Jenkins Analytics can optionally use an embedded Elasticsearch server.

The Elasticsearch http.port setting. This is an unauthenticated HTTP port, so be careful to ensure it is not exposed to untrusted access.

Analytics from cloudbees.com

9300

TCP

In the CloudBees CI component UI, navigate to:
Manage Jenkins Configure AnalyticsAnalyticsElasticsearch ConfigurationNative Port

operations center's Analytics can optionally use an embedded Elasticsearch server.

The Elasticsearch transport.tcp.port setting. This is the bind port for the native Elasticsearch transport client.

Analytics from cloudbees.com

Additional plugins or even your build jobs could run services that open additional ports. Further, running a CloudBees CI component in other Java web containers, Tomcat for example, could open other, container-specific ports.

1 - ports less than 1024 on Linux based systems require a CloudBees CI component to run as root which is not recommended. The Example port column shows examples of how you might configure a CloudBees CI component to appear when fronted by a reverse proxy.

Defining Outbound Ports

For some features, a CloudBees CI component requires outbound access to services on ports as laid out below. Because these are outbound ports which could change, the following table describes the standard ports but your network may run these services on different ports and may require additional configuration.

Standard PortServiceConfigureDescriptionReference

25

SMTP

In the CloudBees CI component UI, navigate to:
Manage Jenkins Configure SystemE-mail NotificationSMTP Port

For sending emails from build failures or via other plugins' email functionality, a CloudBees CI component needs access to an SMTP server.

GMail from jenkins-ci.org

389 (636)

LDAP (LDAPS)

In the CloudBees CI component UI, navigate to:
Manage Jenkins Configure Global SecurityAccess ControlSecurity RealmLDAPServer

If you plan to authenticate a CloudBees CI component user via an LDAP server, the CloudBees CI component will need access to the LDAP or LDAPS port. When accessing Microsoft Active Directory server, design for access to the Active Directory-specific ports, eg: 3268 for the Global Catalog.

LDAP Plugin from jenkins-ci.org

9200

HTTPS

In the CloudBees CI component UI, navigate to:
Manage Jenkins Configure AnalyticsAnalyticsElasticsearch ConfigurationElasticsearch URLs

operations center's CloudBees Analytics can optionally use an external Elasticsearch instance. If so, operations center will need access to this service on the HTTP port.

Analytics from cloudbees.com

The CloudBees CI component will require access to additional outbound ports based on the requirements of your jobs and additional plugins you configure.

Setting a Proxy Configuration

If your network uses a web proxy, you will need to configure a CloudBees CI component to enable access to services outside the network. This is important for access to external services, such as the plugin update site or external source control systems, but is not required for the CloudBees CI component to run. You may also need to set some hosts on the network to bypass the proxy, for example your internally resolved binary artifact repository.

Some plugins rely on proxy settings in different locations, so it is best to set each:

Setting LocationExamplesReference

In the CloudBees CI component UI, navigate to:
Manage Jenkins Manage PluginsAdvancedProxy

  • Plugin Update Center (core)

  • Git Client Plugin

Jenkins Behind Proxy from jenkins-ci.org

  • http.proxyHost, http.proxyPort, http.nonProxyHosts

  • https.proxyHost, https.proxyPort, and https.nonProxyHosts

  • Twitter Plugin

Jenkins Behind Proxy from jenkins-ci.org

Plugin Specific Proxy Settings

  • Subversion SCM Plugin

  • Rally Plugin

Jenkins Behind Proxy from jenkins-ci.org

2 - These properties should automatically default to the corresponding environment variables (http_proxy, no_proxy), but some Java distributions do not support this default.