Ports and Network Requirements

Control plane ports

The Kong Konnect control plane uses the following ports:

Port	Protocol	Description
`443`	TCP HTTPS	Cluster communication port for configuration and telemetry data. The Kong Konnect control plane uses this port to listen for connections and communicate with data plane nodes. The cluster communication port must be accessible to data plane nodes within the same cluster. This port is protected by mTLS to ensure end-to-end security and integrity.
`8071`	TCP UDP	Port used for audit logging.

Kong’s hosted control plane expects traffic on these ports, so they can’t be customized.

Note: If you are unable to make outbound connections using port 443, you can use an existing proxy in your network to make the connection. See Control Plane and Data Plane Communication through a Forward Proxy for details.

Data plane node ports

By default, Kong Gateway listens on the following ports:

Port	Protocol	Description
`8000`	HTTP	Takes incoming HTTP traffic from consumers, and forwards it to upstream services.
`8443`	HTTPS	Takes incoming HTTPS traffic from consumers, and forwards it to upstream services.

Kong Gateway ports can be fully customized. Set them in kong.conf.

For Kubernetes or Docker deployments, map ports as needed. For example, if you want to use port 3001 for the proxy, map 3001:8000.

Hostnames

Control planes

Depending on your control plane type, you may need to add hostnames to your firewall allowlist.

Kong Gateway

Kong Ingress Controller

Data plane nodes initiate the connection to the Konnect control plane. They require access through firewalls to communicate with the control plane.

To let a data plane node request and receive configuration, and send telemetry data, add the following hostnames to the firewall allowlist:

cloud.konghq.com: The Konnect platform.
<region>.api.konghq.com: The Konnect API. Necessary if you are using decK in your workflow, decK uses this API to access and apply configurations. Region can be us, eu, or global.
<controlPlaneId>.<region>.cp0.konghq.com: Handles configuration for a control plane. Data plane nodes connect to this host to receive configuration updates. This hostname is unique to each organization and control plane.
<controlPlaneId>.<region>.tp0.konghq.com: Gathers telemetry data for a control plane. This hostname is unique to each organization and control plane.

You can find the configuration and telemetry hostnames through the Gateway Manager:

Open a control plane.
Select Data Plane Nodes from the side menu, then click the New Data Plane Node button.

Choose the Linux or Kubernetes tab and note the hostnames in the code block for the following parameters:

 cluster_control_plane = example.us.cp0.konghq.com:443
 cluster_server_name = example.us.cp0.konghq.com
 cluster_telemetry_endpoint = example.us.tp0.konghq.com:443
 cluster_telemetry_server_name = example.us.tp0.konghq.com

Kong Ingress Controller initiates the connection to the Konnect Control Planes Configuration API to:

Synchronize the configuration of the Kong Gateway instances with Konnect
Register data plane nodes
Fetch license information

Data plane nodes initiate the connection to Konnect APIs to report Analytics data.

The following hostnames must be allowed through firewalls to enable these connections:

cloud.konghq.com: The Konnect platform.
<region>.api.konghq.com: The Konnect API.
<controlPlaneId>.<region>.tp0.konghq.com: Telemetry endpoint for a control plane, required for Analytics. This hostname is unique to each organization and control plane.

You can find the Telemetry hostname through the Gateway Manager:

Open a control plane.
Click Control Plane Actions > View Connection Instructions.

Look for the following parameter in the Install the KIC section:

 cluster_telemetry_endpoint: "example.us.tp0.konghq.com:443"

Note: Visit https://ip-addresses.origin.konghq.com/ip-addresses.json for the list of IPs associated to regional hostnames. You can also subscribe to https://ip-addresses.origin.konghq.com/rss for updates.

Mesh Manager

If you plan to use Mesh Manager to manage your Kong service mesh, you must add the {region}.mesh.sync.konghq.com:443 hostname to your firewall allowlist. The region can be us, eu, or global.