Secure database ports
All network security starts with strict and proper firewall rules on interfaces that are exposed to the internet, allowing only the absolute minimum traffic in or out of the internal network. Firewall security is especially important when running your infrastructure in a public cloud. Wherever you host your clusters, DataStax strongly recommends using a firewall on all nodes in your cluster.
Begin with a restrictive configuration that blocks all traffic except SSH. Then, open up the following ports in compliance with your security requirements to allow communication between the nodes. If these ports are not opened, the node acts as a standalone database server rather than joining the cluster when you start Hyper-Converged Database (HCD) on a node.
If the cluster uses SSL only, close any non-SSL ports that have dedicated SSL ports. To ensure communication is not disabled to any non-SSL clients, DataStax recommends testing the configuration in a staging environment before enabling the firewall in production environments.
Configuration files
Ports are set in the following configuration files:
cassandra.yaml-
The location of the
cassandra.yamlfile depends on your installation type:-
Package installations:
/etc/hcd/cassandra/cassandra.yaml -
Tarball installations:
INSTALL_DIRECTORY/resources/cassandra/conf/cassandra.yaml
-
cassandra-env.sh-
The location of the
cassandra-env.shfile depends on your installation type:-
Package installations:
/etc/hcd/cassandra/cassandra-env.sh -
Tarball installations:
INSTALL_DIRECTORY/resources/cassandra/conf/cassandra-env.sh
-
HCD ports
You must open the following ports to allow bi-directional communication between nodes in your HCD cluster. Configure the firewall running on nodes in your cluster accordingly.
If you change any of the default ports, make sure your custom ports are open.
If you don’t open the required ports, nodes act as standalone database servers, and they cannot join the cluster.
| Default port number | Traffic | Description | Configuration |
|---|---|---|---|
22 |
Public |
SSH access port. Standard SSH port for administrative access. |
Set at operating system level. |
7000 |
Node-to-node |
Internode communication. Required for nodes to communicate with each other in the cluster. |
Set in |
7001 |
Node-to-node |
SSL-encrypted internode communication. Required for node-to-node encryption. |
Set in |
7199 |
Node-to-node |
JMX monitoring and management operations. DataStax recommends allowing connections only from the local node. |
Set in |
8609 |
Node-to-node |
Internode messaging service port for internal messaging between nodes. |
Set in |
9042 |
Client-to-node |
Native transport port for client connections. This is the primary port for CQL client connections. |
Set in When SSL is enabled, this port can accept both encrypted and unencrypted connections if |
9142 |
Client-to-node |
Dedicated port for SSL-encrypted client connections. |
Set in To separate encrypted and unencrypted client connections, set |
