Confirming Server Network of the FineDataLink Project- FineOps Help Document

Last update: 2026-10-22

Overview

This document describes ports used by components of FineDataLink projects deployed via FineOps and server ports that need to be opened.

Note:

For instructions on port occupancy inspection and firewall configuration, see Port Occupancy Inspection and Firewall Configuration.

Port Occupancy

An O&M project includes many components, and some of them require port mapping to the server, occupying server ports for operation.

Before deployment, ensure that the default ports to be mapped are not in use. If it is already in use, use a free port.

A Single FineDataLink Application Service

Note:

1. This section outlines the port requirements for deploying the FineDataLink project. Components that require no port mapping to the host machine are not listed in the following table.

2. Ensure the port number of the OPS Agent component on the FineDataLink application server and the component server (if you have prepared one) is the same.

Component	Default Port	Description
FineDataLink	8068	A port for the FineDataLink service
FineDataLink	15500	A port for gpfdist
FanRuan Internal Gateway	80	A port for the platform service, which is the port used by users to access the project If you use a non-root user for deployment, use Port 1024 or above.
FanRuan Internal Gateway	80
MySQL	3306	A port for the configuration service
Elasticsearch	9200	A port for the log service
Kafka	9092	A component-occupied port
Kafka	9095	A metrics port
OPS Agent	9070	A port for O&M management

Note:

When opting for custom ports instead of the default ones listed in the table above, steer clear of the following ports.

Type	Reason
Ports not available to non-root users	If using a non-root user for installation, do not use ports below 1024. In a Linux environment, non-root users can only use ports 1024 and above.
Ports deemed insecure by Google Chrome	Google Chrome identifies the following ports as insecure ports with potential security threats. Do not use the following ports, as doing so will prevent Google Chrome from accessing FineOps. 1, 7, 9, 11, 13, 15, 17, 19, 20, 21, 22, 23, 25, 37, 42, 43, 53, 69, 77, 79, 87, 95, 101, 102, 103, 104, 109, 110, 111, 113, 115, 117, 119, 123, 135, 137, 139, 143, 161, 179, 389, 465, 512, 513, 514, 515, 526, 530, 531, 532, 540, 548, 554, 556, 563, 587, 601, 636, 989, 990, 993, 995, 1719, 1720, 1723, 2049, 3659, 4045, 5060, 5061, 6000, 6566, 6665, 6666, 6667, 6668, 6669, 6697, and 10080 Note: Given Google Chrome's ongoing updates, the insecure port list may be updated. For the latest port information, see the official document of Google Chrome.

Type

Reason

Ports not available to non-root users

If using a non-root user for installation, do not use ports below 1024.

In a Linux environment, non-root users can only use ports 1024 and above.

Ports deemed insecure by Google Chrome

Google Chrome identifies the following ports as insecure ports with potential security threats.

Do not use the following ports, as doing so will prevent Google Chrome from accessing FineOps.

1, 7, 9, 11, 13, 15, 17, 19, 20, 21, 22, 23, 25, 37, 42, 43, 53, 69, 77, 79, 87, 95, 101, 102, 103, 104, 109, 110, 111, 113, 115, 117, 119, 123, 135, 137, 139, 143, 161, 179, 389, 465, 512, 513, 514, 515, 526, 530, 531, 532, 540, 548, 554, 556, 563, 587, 601, 636, 989, 990, 993, 995, 1719, 1720, 1723, 2049, 3659, 4045, 5060, 5061, 6000, 6566, 6665, 6666, 6667, 6668, 6669, 6697, and 10080

Note:

Given Google Chrome's ongoing updates, the insecure port list may be updated. For the latest port information, see the official document of Google Chrome.

Multiple FineDataLink Applications

Note:

1. This section outlines the port requirements for deploying the FineDataLink application. Components that require no port mapping to the host machine are not listed in the following table.

2. If you have prepared multiple component servers, ensure the port configuration of all component servers is consistent and meets the requirements, since the components are randomly assigned during installation.

3. Ensure that the OPS Agent component uses the same port number on all servers.

4. If you need to deploy a dual-node internal gateway, ensure you have reserved a port for the FanRuan internal gateway on the main application server.

Server	Component	Default Port	Description
Each main application server	FineDataLink	8068	A port for the FineDataLink service
		7800	A port for TCP communication in the cluster
		7830	A port for file synchronization
		7840	A versatile port for cluster caching
		7850	A port for database caching
		7870	A port for cluster node information management
		15500	A port for gpfdist
	OPS Agent	9070	A port for O&M management
Component server	FanRuan Internal Gateway	80	A port for the platform service, which is the port used by users to access the project When you use a non-root user for deployment, use Port 1024 or above.
	Elasticsearch	9200	A port for the log service
	MySQL	3306	A port for the configuration service
	Redis	6379	A port for the state service
	MinIO	9000	A port for the MinIO API and the Web page
	MinIO	9006	A port for accessing the MinIO console
	Kafka	9092	A component-occupied port
	Kafka	9095	A metrics port
	Nacos	8848	A port for HTTP-based communication
	Nacos	9848	A port for gRPC communication
	Nacos MySQL	3307	A service-occupied port
	OPS Agent	9070	A port for O&M management

Note:

When opting for custom ports instead of the default ones listed in the table above,avoid using the following ports.

Type	Reason
Ports not available to non-root users	If using a non-root user for installation, do not use ports below 1024. In a Linux environment, non-root users can only use ports 1024 and above.
Ports deemed insecure by Google Chrome	Google Chrome identifies the following ports as insecure ports with potential security threats. Do not use the following ports, as doing so will prevent Google Chrome from accessing FineOps. 1, 7, 9, 11, 13, 15, 17, 19, 20, 21, 22, 23, 25, 37, 42, 43, 53, 69, 77, 79, 87, 95, 101, 102, 103, 104, 109, 110, 111, 113, 115, 117, 119, 123, 135, 137, 139, 143, 161, 179, 389, 465, 512, 513, 514, 515, 526, 530, 531, 532, 540, 548, 554, 556, 563, 587, 601, 636, 989, 990, 993, 995, 1719, 1720, 1723, 2049, 3659, 4045, 5060, 5061, 6000, 6566, 6665, 6666, 6667, 6668, 6669, 6697, and 10080 Note: Given Google Chrome's ongoing updates, the insecure port list may be updated. For the latest port information, see the official document of Google Chrome.

Type

Reason

Ports not available to non-root users

If using a non-root user for installation, do not use ports below 1024.

In a Linux environment, non-root users can only use ports 1024 and above.

Ports deemed insecure by Google Chrome

Google Chrome identifies the following ports as insecure ports with potential security threats.

Do not use the following ports, as doing so will prevent Google Chrome from accessing FineOps.

Note:

Given Google Chrome's ongoing updates, the insecure port list may be updated. For the latest port information, see the official document of Google Chrome.

Networking

To ensure normal access to O&M projects and smooth deployment and monitoring of O&M projects via FineOps, certain server ports must be opened for use.

Extranet and O&M Project

Description	Extranet	Relation	O&M Project
For the admin to access O&M Projects	O&M personnel (unlimited IP addresses)	Access ->	Nginx of O&M projects Without SSL: 80 With SSL: 443
For reading or writing data	Business database	<- Access ->	Nginx of O&M projects Without SSL: 80 With SSL: 443 Note: The OceanBase allowlist check may identify the container IP address instead of the host IP address. Therefore, if you need to use an OceanBase-Oracle data connection, additionally ensure that the container IP address of FanRuan application components, such as fr, bi-web, and fdl, can access the OceanBase database port.
For pulling images from the cloud repository	FanRuan cloud image repository	<- Access	Registry: 5000

Description

Extranet

Relation

O&M Project

For the admin to access O&M Projects

O&M personnel

(unlimited IP addresses)

Access ->

Nginx of O&M projects

Without SSL: 80
With SSL: 443

For reading or writing data

Business database

<- Access ->

Nginx of O&M projects

Without SSL: 80
With SSL: 443

Note:

The OceanBase allowlist check may identify the container IP address instead of the host IP address.

Therefore, if you need to use an OceanBase-Oracle data connection, additionally ensure that the container IP address of FanRuan application components, such as fr, bi-web, and fdl, can access the OceanBase database port.

For pulling images from the cloud repository

FanRuan cloud image repository

<- Access

Registry: 5000

O&M Project

Ensure the ports mentioned in the "Port Occupancy" section are interconnected.

FineOps and O&M Project

Description

FineOps

Relation

O&M Project

Basic O&M

FineOps Nginx

Deployed by a root user: 80
Deployed by a non-root user: 8090
With SSL: 443

<- Access

Each application node of the project: 8068

Transmitting the server and component indicator information of the project to FineOps

FineOps Nginx

Deployed by a root user: 80
Deployed by a non-root user: 8090
With SSL: 443

<- Access

OPS Agent on every server of this project (on project nodes and cluster component nodes): 9070

Tracing

FineOps SkyWalking OAP:

11800 and 12800

<- Access

Each FineDataLink application node of the project: 8068

Tracing

FineOps SkyWalking OAP:

11800 and 12800

<- Access

Nginx of the project

Without SSL: 80
With SSL: 443

Pulling components from the image repository of FineOps for project deployment

Registry: 5000

<- Access

The project node and the cluster component node on every server

Collecting monitoring data for the Kafka component

FineOps OPS Agent: 9071

Access ->

The metrics port of the Kafka component in the project: 9095

Network environment requirements for shared servers

Containers of FineOps and FineOps-deployed projects use bridge networks, which provide isolated network environments.

Therefore, if FineOps and FineOps-deployed projects use the same server, you must ensure that port 22 on the host machine of the ops container of FineOps is reachable from the IP address of ops.

Reasons Why FanRuan's Containerized Solution Uses the Bridge Mode Instead of the Host Mode

Network isolation and security: In the Bridge mode, container networks are isolated, preventing port conflicts. In the Host mode, containers share the host's network stack, exposing container ports, which increases security risks.
O&M complexity: Docker uses the Bridge mode by default, enabling unified management of port mappings. Using the Host mode requires manual configuration of ports for each component, making maintenance difficult.
Firewall compatibility: In the Bridge mode, Docker automatically manages firewall rules (for example, managing the Docker zone in firewalld), whereas using the Host mode requires manual port configuration, which is error-prone.
Production suitability: The Host mode is not suitable for production environments due to resource contention (caused by random port usage, for example) and uncontrolled network exposure. The Bridge mode offers greater stability and better aligns with the principles of containerization design.

Previous：Confirming Server Configuration of the FineDataLink Project

Next：Preparing the FineDataLink Mounting Directory

Helpful
Not helpful
Only read

中文（繁體）中文（简体）

English

Confirming Server Network of the FineDataLink Project

Overview

Port Occupancy

A Single FineDataLink Application Service

Multiple FineDataLink Applications

Networking

Extranet and O&M Project

O&M Project

FineOps and O&M Project

Attachment List