Port Reference

Use this reference to plan firewall rules, security groups, Kubernetes Services, and load balancers for AISIX gateways and AISIX Cloud control-plane components.

The tables distinguish defaults from required or example values. Use the values from the deployed startup configuration, Kubernetes Service, or generated AISIX Cloud installation instructions when they differ from the examples.

Start with the gateway ports for any deployment. If the gateway connects to AISIX Cloud, also review AISIX Cloud Gateway Connectivity. For an On-Premises deployment, review On-Premises Control-Plane Ports as well.

AISIX Gateway Ports

Every AISIX gateway binds the proxy listener. An open-source AISIX gateway can also bind an admin listener; a gateway connected to AISIX Cloud does not. Outbound requirements depend on the gateway's configuration source and configured runtime destinations.

Listener or Connection	Configuration	Address or Port Behavior	Traffic and Purpose	Exposure
Proxy listener	proxy.addr	Required; the example configuration uses 0.0.0.0:3000.	Inbound caller-facing AI APIs and the /livez and /readyz health routes.	Expose only to intended callers or the ingress tier in front of the gateway.
Admin listener	admin.addr	Defaults to the unusable address 127.0.0.1:0; the example configuration uses 127.0.0.1:3001.	Inbound to an open-source gateway for the read-only gateway Admin API, its OpenAPI document and Scalar UI, the playground, and health routes.	Keep private or bound to loopback. Authenticated resource reads can return sensitive configuration, while health and OpenAPI discovery routes are unauthenticated. This listener is not bound when the gateway connects to AISIX Cloud.
Metrics and status listener	observability.metrics.prometheus.addr	Defaults to 0.0.0.0:9090 when Prometheus metrics are enabled.	Inbound for the configured Prometheus path and /status/config, /status/ready, and /status/models.	Keep private to Prometheus and operations systems. These routes do not require application authentication.
etcd	etcd.endpoints	No default; external etcd commonly uses client port 2379.	Outbound from an open-source gateway that loads dynamic resources from etcd.	Keep etcd private to AISIX and the systems that manage gateway configuration. This connection is not used with a resources file.
AISIX Cloud management	managed.cp_base_url	No default; an HTTPS URL without an explicit port uses 443.	Outbound for registration, heartbeat, telemetry, budget checks, and certificate rotation.	Allow gateways to initiate connections to the configured endpoint. The control plane does not initiate connections to gateway hosts.
AISIX Cloud configuration store	managed.cp_etcd_endpoint	When unset, the gateway uses the host and port from managed.cp_base_url.	Optional outbound connection to a separate AISIX Cloud configuration-store endpoint.	Allow the configured port only when the generated installation configuration supplies this endpoint.

Runtime destinations do not share default ports. When building an egress allowlist, permit every endpoint named in the gateway's startup or resource configuration. This includes model providers, guardrail services, MCP servers, A2A agents, OIDC issuers, Redis backends, and telemetry exporters.

Configure AISIX Gateway Ports

The startup configuration defines the gateway listener ports and, for an open-source gateway that uses etcd, the external etcd endpoint. For a gateway connected to AISIX Cloud, use the management endpoints in the generated installation instructions; see AISIX Cloud Gateway Connectivity.

Set the proxy listener with proxy.addr:

proxy:
  addr: "0.0.0.0:3000"

The proxy listener address is required in startup configuration.

For an open-source gateway, admin.enabled defaults to true. To expose the read-only gateway Admin API, override the unusable default admin.addr value of 127.0.0.1:0 with a private or loopback address and configure at least one admin.admin_keys value. Set admin.enabled to false to disable the listener. A gateway connected to AISIX Cloud never binds this listener, regardless of these settings.

Set observability.metrics.prometheus.addr to change the dedicated metrics and status listener address. This listener runs when Prometheus metrics are enabled and defaults to 0.0.0.0:9090:

observability:
  metrics:
    prometheus:
      enabled: true
      path: "/metrics"
      addr: "0.0.0.0:9090"

The metrics/status listener also serves /status/config, /status/ready, and /status/models. These operational routes are unauthenticated. Bind the listener to a private interface or restrict it with network policy or firewall rules.

For an open-source gateway that uses etcd, configure every endpoint with its actual client port:

etcd:
  endpoints:
    - "https://etcd.internal.example:2379"

Use mTLS when the etcd connection crosses a host or network trust boundary. See TLS and mTLS.

AISIX Cloud Gateway Connectivity

Gateways initiate all management connections to AISIX Cloud. The control plane does not initiate connections to gateway hosts, and live caller traffic does not pass through it.

For Hybrid Cloud, API7 hosts the control plane, so operators do not deploy control-plane services. Allow outbound TCP connections from each gateway to the exact management and configuration-store endpoints in the generated installation instructions. Do not create an inbound control-plane-to-gateway firewall rule.

For On-Premises, gateways connect to the dp-manager endpoint over mTLS. Make that endpoint reachable from every gateway host or cluster. Set its gateway-reachable address with AISIX_CLOUD_DPMGR_BASE_URL for Docker Compose or api.dpmgrBaseURL for Helm. The control plane puts this address into generated gateway installation instructions and uses its host in the dp-manager server certificate.

On-Premises Control-Plane Ports

In an On-Premises deployment, browser and Admin API traffic use a different entry point from gateway management traffic. Keep internal dashboard and database traffic on the deployment network.

Default Port	Component	Purpose	Exposure
8080	cp-api	Browser-facing dashboard entry point and AISIX Cloud Admin API. cp-api reverse-proxies dashboard requests to the internal dashboard service.	Expose through the intended control-plane origin. Use a TLS-terminating reverse proxy or load balancer for production.
7944	dp-manager	mTLS endpoint used by gateways for registration, configuration delivery, heartbeat, telemetry, and budget checks. HTTPS APIs and the configuration-store protocol share this port.	Expose only to networks that run AISIX gateways. Preserve end-to-end TLS to dp-manager.
3000	Dashboard	Internal dashboard service reached by cp-api. This is separate from the gateway proxy listener, which also defaults to 3000.	Do not publish directly.
5432	PostgreSQL	Database traffic from cp-api, dp-manager, and the dashboard.	Keep private to the control-plane services and database administrators.
7946	dp-manager health server	Plain-HTTP /healthz listener. The default Helm deployment uses it for Kubernetes probes; Docker Compose does not publish it. It is not part of the dp-manager Service.	Keep inside the pod or container network. Do not publish to gateway or operator networks.

Control-Plane Egress

Some control-plane features initiate outbound connections from cp-api. Their ports come from the configured destination URLs rather than from fixed AISIX defaults.

Destination	When Required
Configured LLM endpoints	Dashboard playground and semantic-routing test requests.
Configured webhook or Slack destinations	Budget notification delivery.
https://models.dev/api.json or AISIX_CLOUD_PRICESYNC_URL	Online model-pricing synchronization. The packaged Docker Compose deployment uses an offline snapshot by default and does not require this connection.

For a default-deny egress policy, allow the destination port for each enabled feature. HTTP and HTTPS URLs use ports 80 and 443, respectively, when the URL does not specify a port.

Docker Compose Port Mappings

Docker Compose publishes the following container ports on the host. Changing a host binding does not change the corresponding container port.

Variable	Default Host Binding	Container Port
API_HOST_PORT	8080	8080
DPM_HOST_PORT	7944	7944
POSTGRES_HOST_PORT	127.0.0.1:5432	5432

The default API_HOST_PORT and DPM_HOST_PORT values bind to all host network interfaces. Prefix a value with 127.0.0.1:, such as 127.0.0.1:8080, to restrict a local-only deployment to loopback. When a gateway runs on another host or cluster, expose the dp-manager endpoint at the hostname and port in AISIX_CLOUD_DPMGR_BASE_URL.

The dashboard listens on port 3000 only inside the Compose network. It has no host port because cp-api serves it through port 8080.

Helm Service Ports

The default Helm chart creates ClusterIP Services. Publish only the services that clients outside the cluster need.

Helm Value	Default	Consumers
api.service.port	8080	Operators, browsers, and Admin API clients through the configured control-plane origin
dpm.service.port	7944	AISIX gateways
ui.service.port	3000	cp-api inside the cluster
postgresql.primary.service.ports.postgresql	5432	Control-plane services inside the cluster

If gateways run outside the cluster, provide a TCP path to the dp-manager Service that preserves its mTLS connection, then set api.dpmgrBaseURL to the externally reachable URL. The dp-manager health listener on port 7946 remains pod-internal and is not part of this Service.

For all On-Premises configuration variables and Helm values, see On-Premises Configuration Reference.