Configuring network requirements

Traditional Platforms

This content applies only to CloudBees CI on traditional platforms.

CloudBees CI’s components (the client controller and operations center server) run services that require network communication over several configurable ports. You should open ports according to the services you plan to use.

Defining Inbound (Listening) Ports

Each CloudBees CI component listens for connections on the ports listed below. Many of these ports are used for optional services and can be disabled or enabled according to your needs.

Default Port Example Port ¹ Service Configure Description Reference

Default Port	Example Port ¹	Service	Configure	Description	Reference
8080	80	HTTP	Specify the command line option `--httpPort=$HTTP_PORT`, where `$HTTP_PORT` is the new value of this HTTP listening port. (Specify the value `-1` to disable this port.)	When leveraging the built-in Jetty servlet container, a CloudBees CI component defaults to listening on port 8080 for the component’s web application.	Starting and Accessing Jenkins from www.jenkins.io
Disabled	443	HTTPS	Specify the command line option `--httpsPort=$HTTP_PORT`, where `$HTTP_PORT` is the new value of this HTTPS listening port. (Specify the value `-1` to disable this port.)	When leveraging the built-in servlet container, a CloudBees CI component can optionally respond over HTTPS.	Starting and Accessing Jenkins from www.jenkins.io
Disabled or 50000	50000	JNLP	In the CloudBees CI component UI, navigate to: Manage Jenkins Configure Global Security TCP port for JNLP agents	A CloudBees CI component exposes a port for agents to connect via the Java Network Launch Protocol (JNLP). It is also the primary port used by the Jenkins CLI. Operations center uses this port for client controller connectivity.	Distributed Builds from jenkins-ci.org
Random	2222	SSH	In the CloudBees CI component UI, navigate to: Manage Jenkins Configure System SSH Server SSHD Port	A CloudBees CI component runs an SSH server, exposing a subset of CLI commands and allowing plugins to add functionality over SSH.	Jenkins SSH from jenkins-ci.org
9200		HTTP	In the CloudBees CI component UI, navigate to: Manage Jenkins Configure Analytics Analytics Elasticsearch Configuration HTTP Port	The Elasticsearch `http.port` setting. This is an unauthenticated HTTP port, so be careful to ensure it is not exposed to untrusted access.	Analytics from cloudbees.com
9300		TCP	In the CloudBees CI component UI, navigate to: Manage Jenkins Configure Analytics Analytics Elasticsearch Configuration Native Port	The Elasticsearch `transport.tcp.port` setting. This is the bind port for the native Elasticsearch transport client.	Analytics from cloudbees.com
5701		TCP	Hazelcast. A Java library used by CloudBees CI to synchronize controller replicas when running in High Availability mode.

8080

HTTP

Specify the command line option
--httpPort=$HTTP_PORT, where $HTTP_PORT is the new value of this HTTP listening port.
(Specify the value -1 to disable this port.)

When leveraging the built-in Jetty servlet container, a CloudBees CI component defaults to listening on port 8080 for the component’s web application.

Starting and Accessing Jenkins from www.jenkins.io

Disabled

443

HTTPS

Specify the command line option
--httpsPort=$HTTP_PORT, where $HTTP_PORT is the new value of this HTTPS listening port.
(Specify the value -1 to disable this port.)

When leveraging the built-in servlet container, a CloudBees CI component can optionally respond over HTTPS.

Starting and Accessing Jenkins from www.jenkins.io

Disabled or
50000

50000

JNLP

In the CloudBees CI component UI, navigate to:
Manage Jenkins Configure Global Security TCP port for JNLP agents

A CloudBees CI component exposes a port for agents to connect via the Java Network Launch Protocol (JNLP). It is also the primary port used by the Jenkins CLI.

Operations center uses this port for client controller connectivity.

Distributed Builds from jenkins-ci.org

Random

2222

SSH

In the CloudBees CI component UI, navigate to:
Manage Jenkins Configure System SSH Server SSHD Port

A CloudBees CI component runs an SSH server, exposing a subset of CLI commands and allowing plugins to add functionality over SSH.

Jenkins SSH from jenkins-ci.org

9200

HTTP

In the CloudBees CI component UI, navigate to:
Manage Jenkins Configure Analytics Analytics Elasticsearch Configuration HTTP Port

The Elasticsearch http.port setting. This is an unauthenticated HTTP port, so be careful to ensure it is not exposed to untrusted access.

Analytics from cloudbees.com

9300

TCP

In the CloudBees CI component UI, navigate to:
Manage Jenkins Configure Analytics Analytics Elasticsearch Configuration Native Port

The Elasticsearch transport.tcp.port setting. This is the bind port for the native Elasticsearch transport client.

Analytics from cloudbees.com

5701

TCP

Hazelcast. A Java library used by CloudBees CI to synchronize controller replicas when running in High Availability mode.

Additional plugins or even your build jobs could run services that open additional ports. Further, running a CloudBees CI component in other Java web containers, Tomcat for example, could open other, container-specific ports.

¹ - ports less than 1024 on Linux based systems require a CloudBees CI component to run as root which is not recommended. The Example port column shows examples of how you might configure a CloudBees CI component to appear when fronted by a reverse proxy.

Defining Outbound Ports

For some features, a CloudBees CI component requires outbound access to services on ports as laid out below. Because these are outbound ports which could change, the following table describes the standard ports but your network may run these services on different ports and may require additional configuration.

Standard Port Service Configure Description Reference

Standard Port	Service	Configure	Description	Reference
25	SMTP	In the CloudBees CI component UI, navigate to: Manage Jenkins Configure System E-mail Notification SMTP Port	For sending emails from build failures or via other plugins' email functionality, a CloudBees CI component needs access to an SMTP server.	GMail from jenkins-ci.org
389 (636)	LDAP (LDAPS)	In the CloudBees CI component UI, navigate to: Manage Jenkins Configure Global Security Access Control Security Realm LDAP Server	If you plan to authenticate a CloudBees CI component user via an LDAP server, the CloudBees CI component will need access to the LDAP or LDAPS port. When accessing Microsoft Active Directory server, design for access to the Active Directory-specific ports, eg: 3268 for the Global Catalog.	LDAP Plugin from jenkins-ci.org
9200	HTTPS	In the CloudBees CI component UI, navigate to: Manage Jenkins Configure Analytics Analytics Elasticsearch Configuration Elasticsearch URLs	operations center's CloudBees Analytics can optionally use an external Elasticsearch instance. If so, operations center will need access to this service on the HTTP port.	Analytics from cloudbees.com
22	ssh	In the CloudBees CI UI, when setting up an ssh agent, under Launch method, select Advanced, and then modify the Port field from its default value of 22. This is helpful if your build agent’s `sshd` is listening on a different port than the default port 22.	If you are not using ssh-connected build agents, this outbound port is not required to be opened.	CloudBees SSH Build Agents plugin or SSH Build Agents

SMTP

In the CloudBees CI component UI, navigate to:
Manage Jenkins Configure System E-mail Notification SMTP Port

For sending emails from build failures or via other plugins' email functionality, a CloudBees CI component needs access to an SMTP server.

GMail from jenkins-ci.org

389 (636)

LDAP (LDAPS)

In the CloudBees CI component UI, navigate to:
Manage Jenkins Configure Global Security Access Control Security Realm LDAP Server

If you plan to authenticate a CloudBees CI component user via an LDAP server, the CloudBees CI component will need access to the LDAP or LDAPS port. When accessing Microsoft Active Directory server, design for access to the Active Directory-specific ports, eg: 3268 for the Global Catalog.

LDAP Plugin from jenkins-ci.org

9200

HTTPS

In the CloudBees CI component UI, navigate to:
Manage Jenkins Configure Analytics Analytics Elasticsearch Configuration Elasticsearch URLs

operations center's CloudBees Analytics can optionally use an external Elasticsearch instance. If so, operations center will need access to this service on the HTTP port.

Analytics from cloudbees.com

ssh

In the CloudBees CI UI, when setting up an ssh agent, under Launch method, select Advanced, and then modify the Port field from its default value of 22. This is helpful if your build agent’s sshd is listening on a different port than the default port 22.

If you are not using ssh-connected build agents, this outbound port is not required to be opened.

CloudBees SSH Build Agents plugin or SSH Build Agents

The CloudBees CI component will require access to additional outbound ports based on the requirements of your jobs and additional plugins you configure.

Setting a Proxy Configuration

If your network uses a web proxy, you will need to configure a CloudBees CI component to enable access to services outside the network. This is important for access to external services, such as the plugin update site or external source control systems, but is not required for the CloudBees CI component to run. You may also need to set some hosts on the network to bypass the proxy, for example your internally resolved binary artifact repository.

Some plugins rely on proxy settings in different locations, so it is best to set each:

Setting Location Examples Reference

Setting Location	Examples	Reference
In the CloudBees CI component UI, navigate to: Manage Jenkins System HTTP Proxy Configuration (previously under Manage Jenkins Manage Plugins Advanced Proxy)	Plugin Update Center (core) Git Client Plugin	Jenkins Behind Proxy from www.jenkins.io
JVM Proxy Properties ²: `http.proxyHost`, `http.proxyPort`, `http.nonProxyHosts` `https.proxyHost`, `https.proxyPort`	Twitter Plugin	Jenkins Behind Proxy from www.jenkins.io
Plugin Specific Proxy Settings	Subversion SCM Plugin Rally Plugin	Jenkins Behind Proxy from www.jenkins.io

In the CloudBees CI component UI, navigate to:
Manage Jenkins System HTTP Proxy Configuration (previously under Manage Jenkins Manage Plugins Advanced Proxy)

Plugin Update Center (core)
Git Client Plugin

Jenkins Behind Proxy from www.jenkins.io

JVM Proxy Properties ²:

http.proxyHost, http.proxyPort, http.nonProxyHosts
https.proxyHost, https.proxyPort

Twitter Plugin

Jenkins Behind Proxy from www.jenkins.io

Plugin Specific Proxy Settings

Subversion SCM Plugin
Rally Plugin

Jenkins Behind Proxy from www.jenkins.io

² - These properties should automatically default to the corresponding environment variables (http_proxy, no_proxy), but some Java distributions do not support this default.

In August 2020, the Jenkins project voted to replace the term master with controller. We have taken a pragmatic approach to cleaning these up, ensuring the least amount of downstream impact as possible. CloudBees is committed to ensuring a culture and environment of inclusiveness and acceptance - this includes ensuring the changes are not just cosmetic ones, but pervasive. As this change happens, please note that the term master has been replaced through the latest versions of the CloudBees documentation with controller (as in managed controller, client controller, team controller) except when still used in the UI or in code.