Reference
Ports and network
Every network connection SQL Flow makes, with its direction, default port, protocol and the setting that changes it.
This table lists every connection between SQL Flow components, your databases and outside services. The arrow points from the side that opens the connection. Allow the connection in that direction only; no reply rule is needed beyond normal stateful firewalling. For the rules to open on each host, see Network and ports.
Connections
| From | To | Default port | Protocol | Purpose | Change it with |
|---|---|---|---|---|---|
| Browser, CLI | Control plane | 443 (hosted); 5100 (container image) | HTTPS | UI and CLI | Hosted: fixed. Air-gapped: ASPNETCORE_URLS or Kestrel:Endpoints. |
| Agent | Control plane | Same as above | HTTPS | Enrollment, configuration, commands, status, metrics and logs | The agent's --control-plane URL |
| Log broker | Control plane | Same as above | HTTPS | Registration, configuration and status | The broker's --control-plane URL |
| Agent | Log broker | 7003 | TLS 1.3 over TCP, or TLS 1.2 on Windows hosts without TLS 1.3 | Reading transaction-log files | Broker:ListenPort on the control plane; --listen-port for a second broker on the same host |
| Capture agent | Apply agent | 7420 | Mutual TLS 1.3 over TCP | Relay of change packets | The port on the wizard's relay pairing; Relay:ListenPort on the control plane for the default |
| Agent | Source database | The engine's port, for example 1433, 1521, 5432, 3306 | The engine's protocol, with TLS as the connection's Encryption setting decides (Require by default) | Initial load, capture and connection tests | The connection's port |
| Agent | Target | The engine's or service's port | The engine's or service's protocol, with TLS as for a source | Apply | The connection's port |
| Control plane | PostgreSQL | 5432 | PostgreSQL, TLS recommended | The control plane's store (air-gapped) | ConnectionStrings:SqlFlow |
| Control plane | Webhook endpoints | 443 or the URL's port | HTTPS or HTTP | Notifications | The channel URL |
| Control plane | Mail provider | 443 | HTTPS | Welcome and password-reset mail (optional, air-gapped) | Postmark:* settings |
| Browser | Download storage, Azure Blob Storage at <account>.blob.core.windows.net | 443 | HTTPS | CLI, agent and broker downloads from Downloads, Add agent and Add broker | Downloads:* settings (air-gapped) |
Nothing connects to an agent or a broker from the control plane. The only inbound ports on agent and broker hosts are the broker's data port and, on an apply agent in a relay pipeline, the relay port.
Listener details
- Control plane: binds the addresses in
ASPNETCORE_URLSorKestrel:Endpoints; the container image setshttps://+:5100. It doesn't start without at least onehttps://binding, and anhttp://binding beside it only redirects. - Log broker data port: listens on all interfaces and accepts only the agent addresses in
--allow-ips. - Relay listener on the apply agent: opens only while the agent runs the apply half of a relay pipeline. It binds the pairing's address when that is a local IP address, and otherwise all interfaces.
Name resolution
- Agents to brokers. An agent dials a broker by the broker host's machine name. When that name doesn't resolve from the agent, record an address on the pipeline wizard's Broker step.
- Capture agent to apply agent. When the apply agent's registered name and addresses aren't reachable from the capture agent, set Relay host on the pairing. See Relay.
- Agents and brokers to the control plane. The host name in their install command must be one the control plane's certificate names. See Air-gapped deployment.
Proxies and load balancers
The control plane holds an agent's command request open for up to 20 seconds. Set idle and server timeouts on any proxy or load balancer in front of the control plane above 20 seconds, so these requests aren't cut.
If the control plane is unreachable, agents and brokers keep running the work they already have for up to 24 hours.
