BryanNetPorts firewall and secure connectivity
Prerequisites and authority
Use this reference with your installed release. Internal implementation routes and settings are not public integration contracts.
Network ports and exposure
| Connection | Inspected/default value | Intended exposure |
|---|---|---|
| API host listener | TCP 8000, configurable | Controlled ingress/LAN |
| Admin host listener | TCP 5173, configurable | Authorized staff |
| Customer web listener | TCP 5174, configurable | Entitled customers via HTTPS |
| MySQL service | TCP 3306 internal | Docker network; temporary localhost support only |
| RouterOS API | TCP 8728 conventional | Private management LAN/VPN |
| RouterOS API-SSL | TCP 8729 conventional | Only tested TLS mode |
| Bot health | 8081 inside container | Internal health check |
| VPN transport | Chosen UDP port | Selected VPN endpoint |
| Production HTTPS ingress | Normally TCP 443 | Required public web/callback routes |
Host ports can be overridden; public HTTPS ingress can forward to local origins without publishing all application ports. Do not assume Compose bindings are localhost-only: firewall/ingress policy must be reviewed.
Permit API-to-router traffic, and router-to-platform events where bootstrap requires them. For site gateways, include forward and return routes. Protect both input and forwarded management traffic.
Provider/tunnel/license connectivity uses the configured external endpoints. Allow only required outbound paths and verify them during acceptance.
Keep MySQL and RouterOS API off the public internet. Temporary Workbench exposure uses the approved loopback overlay and must be removed afterward. Use LAN access, firewall, DNS and HTTPS/14 and Connecting remote sites through WireGuard for implementation procedures.
Related guides
Related guides: Configuration reference (env vars, ports, URLs), Docker services, Compose files and persistent volumes, Database diagnostics and safe query reference, Subscription and provisioning state model.