Ports and Network Requirements
Control plane ports
The Kong Konnect control plane uses the following ports:
Port | Protocol | Description |
---|---|---|
443 |
TCP HTTPS |
Cluster communication port for configuration and telemetry data. The Kong Konnect control plane uses this port to listen for connections and communicate with data plane nodes. The cluster communication port must be accessible to data plane nodes within the same cluster. This port is protected by mTLS to ensure end-to-end security and integrity. |
8071 |
TCP UDP |
Port used for audit logging. |
Kong’s hosted control plane expects traffic on these ports, so they can’t be customized.
Note: If you are unable to make outbound connections using port
443
, you can use an existing proxy in your network to make the connection. See Control Plane and Data Plane Communication through a Forward Proxy for details.
Data plane node ports
By default, Kong Gateway listens on the following ports:
Port | Protocol | Description |
---|---|---|
8000 |
HTTP | Takes incoming HTTP traffic from consumers, and forwards it to upstream services. |
8443 |
HTTPS | Takes incoming HTTPS traffic from consumers, and forwards it to upstream services. |
Kong Gateway ports can be fully customized. Set them in kong.conf
.
For Kubernetes or Docker deployments, map ports as needed. For example, if you
want to use port 3001
for the proxy, map 3001:8000
.
Kong Gateway hostnames
Data plane nodes initiate the connection to the Konnect control plane. They require access through firewalls to communicate with the control plane.
To let a data plane node request and receive configuration, and send telemetry data, add the following hostnames to the firewall allowlist (depending on the geographic regions you use).
AU geo
Hostname | Description |
---|---|
cloud.konghq.com |
The Konnect platform. |
global.api.konghq.com |
The Konnect API for platform authentication, identity, permissions, teams, and organizational entitlements and settings. |
au.api.konghq.com |
The Konnect API for the AU geo. Necessary if you are using decK in your workflow, decK uses this API to access and apply configurations. |
PORTAL_ID.au.portal.konghq.com |
The URL for the Dev Portal in the AU geo. |
CONTROL_PLANE_ID.au.cp0.konghq.com |
Handles configuration for a control plane in the AU geo. Data plane nodes connect to this host to receive configuration updates. This hostname is unique to each organization and control plane. |
CONTROL_PLANE_ID.au.tp0.konghq.com |
Gathers telemetry data for a control plane in the AU geo. This hostname is unique to each organization and control plane. |
EU geo
Hostname | Description |
---|---|
cloud.konghq.com |
The Konnect platform. |
global.api.konghq.com |
The Konnect API for platform authentication, identity, permissions, teams, and organizational entitlements and settings. |
eu.api.konghq.com |
The Konnect API for the EU geo. Necessary if you are using decK in your workflow, decK uses this API to access and apply configurations. |
PORTAL_ID.eu.portal.konghq.com |
The URL for the Dev Portal in the EU geo. |
CONTROL_PLANE_DNS_PREFIX.eu.cp0.konghq.com |
Handles configuration for a control plane in the EU geo. Data plane nodes connect to this host to receive configuration updates. This hostname is unique to each organization and control plane. |
CONTROL_PLANE_ID.eu.tp0.konghq.com |
Gathers telemetry data for a control plane in the EU geo. This hostname is unique to each organization and control plane. |
US geo
Hostname | Description |
---|---|
cloud.konghq.com |
The Konnect platform. |
global.api.konghq.com |
The Konnect API for platform authentication, identity, permissions, teams, and organizational entitlements and settings. |
us.api.konghq.com |
The Konnect API for the US geo. Necessary if you are using decK in your workflow, decK uses this API to access and apply configurations. |
PORTAL_ID.us.portal.konghq.com |
The URL for the Dev Portal in the US geo. |
CONTROL_PLANE_ID.us.cp0.konghq.com |
Handles configuration for a control plane in the US geo. Data plane nodes connect to this host to receive configuration updates. This hostname is unique to each organization and control plane. |
CONTROL_PLANE_ID.us.tp0.konghq.com |
Gathers telemetry data for a control plane in the US geo. This hostname is unique to each organization and control plane. |
Find configuration and telemetry hostnames
You can find the configuration and telemetry hostnames through the Gateway Manager or the Konnect Control Planes API:
Kong Ingress Controller hostnames
Kong Ingress Controller initiates the connection to the Konnect Control Planes Configuration API to:
- Synchronize the configuration of the Kong Gateway instances with Konnect
- Register data plane nodes
- Fetch license information
Data plane nodes initiate the connection to Konnect APIs to report Analytics data.
Add the following hostnames to the firewall allowlist (depending on the geographic regions you use).
AU geo
Hostname | Description |
---|---|
cloud.konghq.com |
The Konnect platform. |
global.api.konghq.com |
The Konnect API for platform authentication, identity, permissions, teams, and organizational entitlements and settings. |
au.api.konghq.com |
The Konnect API for the AU geo. Necessary if you are using decK in your workflow, decK uses this API to access and apply configurations. |
PORTAL_ID.au.portal.konghq.com |
The URL for the Dev Portal in the AU geo. |
CONTROL_PLANE_ID.au.cp0.konghq.com |
Handles configuration for a control plane in the AU geo. Data plane nodes connect to this host to receive configuration updates. This hostname is unique to each organization and control plane. |
CONTROL_PLANE_ID.au.tp0.konghq.com |
Gathers telemetry data for a control plane in the AU geo. This hostname is unique to each organization and control plane. |
EU geo
Hostname | Description |
---|---|
cloud.konghq.com |
The Konnect platform. |
global.api.konghq.com |
The Konnect API for platform authentication, identity, permissions, teams, and organizational entitlements and settings. |
eu.api.konghq.com |
The Konnect API for the EU geo. Necessary if you are using decK in your workflow, decK uses this API to access and apply configurations. |
PORTAL_ID.eu.portal.konghq.com |
The URL for the Dev Portal in the EU geo. |
CONTROL_PLANE_ID.eu.cp0.konghq.com |
Handles configuration for a control plane in the EU geo. Data plane nodes connect to this host to receive configuration updates. This hostname is unique to each organization and control plane. |
CONTROL_PLANE_ID.eu.tp0.konghq.com |
Gathers telemetry data for a control plane in the EU geo. This hostname is unique to each organization and control plane. |
US geo
Hostname | Description |
---|---|
cloud.konghq.com |
The Konnect platform. |
global.api.konghq.com |
The Konnect API for platform authentication, identity, permissions, teams, and organizational entitlements and settings. |
us.api.konghq.com |
The Konnect API for the US geo. Necessary if you are using decK in your workflow, decK uses this API to access and apply configurations. |
PORTAL_ID.us.portal.konghq.com |
The URL for the Dev Portal in the US geo. |
CONTROL_PLANE_ID.us.cp0.konghq.com |
Handles configuration for a control plane in the US geo. Data plane nodes connect to this host to receive configuration updates. This hostname is unique to each organization and control plane. |
CONTROL_PLANE_ID.us.tp0.konghq.com |
Gathers telemetry data for a control plane in the US geo. This hostname is unique to each organization and control plane. |
Find configuration and telemetry hostnames
Note: Visit https://ip-addresses.origin.konghq.com/ip-addresses.json for the list of IPs associated to regional hostnames. You can also subscribe to https://ip-addresses.origin.konghq.com/rss for updates.
Mesh Manager hostnames
If you plan to use Mesh Manager to manage your Kong service mesh, you must add the {geo}.mesh.sync.konghq.com:443
hostname to your firewall allowlist. The geo can be au
, eu
, us
, or global
.