Last Updated: 2026-08-11
Purpose
This article describes the firewall requirements for communication between RC-Scanner and Outscan. It defines the required and optional inbound and outbound ports, protocols, and network destinations.
Introduction
This document covers both inbound and outbound network traffic, specifying the ports, protocols, and sources or destinations necessary for the cluster to function correctly and securely.
The inbound rules are for traffic entering the node, the outbound rules are for traffic leaving the node.
Inbound rules
|
Service |
Destination |
Port / Protocol |
Description |
|---|---|---|---|
|
SSH |
RC-Scanner Node IP |
22 / TCP |
SSH for machine access, should be restricted to known IPs |
Inbound rules (optional)
|
Service |
Destination |
Port / Protocol |
Description |
|---|---|---|---|
|
Kubernetes API |
RC-Scanner Node IP |
6443 / TCP |
Optional if the user wants to control the cluster remotely using kubectl clients |
|
NodePort |
RC-Scanner Node IP |
30000-32767 / TCP-UDP |
Optional if the user wants to access ArgoCD, ArgoWF UI
ArgoWF: Port 32746 |
Outbound rules
|
Service |
Destination |
Port / Protocol |
Description |
|---|---|---|---|
|
Outscan |
outscan.outpost24.com |
443 / TCP |
Communication with Outscan |
|
containerd |
registry.outpost24.com |
443 / TCP |
Image pulls via internal mirror |
|
ArgoCD |
gitlab.com |
443 / TCP |
GitOps repository sync |
|
AWS S3 |
*.s3.<region>.amazonaws.com |
443 / TCP |
Download/upload scan configurations/blueprints |
|
CoreDNS |
Per-node /etc/resolv.conf |
53 / TCP+UDP |
External DNS resolution for pods |
|
NTP client |
Per-node NTP configuration |
123 / UDP |
Time sync for TLS certs |
Related Articles