Appearance
Network and Ports
Plan the ports and network paths used by each Turbo Server role, including direct and tunneled connectivity between hosts.
What You'll Learn
- Which ports are public and which stay internal
- Direct versus tunneled connectivity between hosts
- What outbound access Turbo Server needs
Public Edge
External users reach only the gateway.
| Port | Purpose | External |
|---|---|---|
80 | Gateway, HTTP | Optional, typically redirects to HTTPS |
443 | Gateway, HTTPS | Yes |
The gateway terminates TLS and proxies external traffic to the services behind it, so the portal, API, admin interface, and dashboards are all served through these two ports. Port 443 binds only when a valid certificate is configured.
Open these only on hosts running the gateway, typically the Controller.
If another service already holds port 80 on that host, move the gateway during provisioning. Port 9090 is the conventional choice and avoids the privileged-port restriction on Linux.
Internal Ports
These carry traffic between hosts in the domain and are not exposed to the internet.
| Port | Service |
|---|---|
8079 | Node agent, for per-host diagnostics and log retrieval |
8080 | Portal |
8081 | Admin |
8082 | API |
8083 | Analytics |
8084 | Hub |
8085 | Peer-to-peer tracker |
8086 | Update API |
8087 | Update web |
8088 | Application service |
8089 | Controller |
8090 | Controller, pinned-TLS bootstrap |
Application hosts use 3389 for the local Remote Desktop connection and 5851 for the native RDP proxy. Do not expose either port to the internet. In the default HTTP direct mode, the gateway host must reach port 5851 on each remote Application host. When internal HTTPS is enabled, the gateway sends media through the Application service on port 8088 instead.
Connectivity Between Hosts
Direct Mode
Direct mode is the default. Hosts connect over internal ports that must be reachable from peer hosts but not from the internet. Restrict access by source address.
| Role | Ports peers must reach |
|---|---|
| Controller | 8089 for heartbeats and config sync, 8090 for the pinned-TLS bootstrap, plus 8079 |
| Application | 8088 for session brokering and HTTPS media relay, 8079 for node operations, and 5851 for media when the internal transport is HTTP (the default) |
| Hub | 8084 for image storage, 8085 for the tracker, plus 8079 |
| Portal only | 8079 |
Use this when hosts sit on one trusted network segment. It keeps the data path shortest.
Tunnel Mode
Each satellite host maintains an outbound control connection to the Controller. Application-session media also uses an outbound connection from the Application host. Hub image and tracker traffic remains direct and therefore still requires the inbound Hub ports shown below.
| Role | Inbound ports peers must reach |
|---|---|
| Controller | 8089 or gateway 443, plus 8090 |
| Application | None |
| Hub | 8084 and 8085. Bulk image data is not tunneled. |
| Portal only | None |
When you enable tunnel mode, Turbo Server binds tunneled Application and node-agent listeners to loopback. Keep host firewall policy in place as defense in depth.
Use this when hosts sit across network boundaries: a separate subnet, a DMZ, a cloud region, or anywhere inbound rules are difficult to obtain.
WARNING
Enable tunnel mode only after every host has been upgraded to a release that supports it. A host without tunnel support becomes unreachable for control operations until you upgrade it or switch the domain back to direct mode.
Host Firewalls
Each service authenticates callers. Use host firewalls as an additional control because any open internal port is reachable by systems that can route to the host.
On a single-host deployment, allow your administrative access method and the configured gateway ports—normally 80 and 443, or the alternate port selected during provisioning. Default all other inbound traffic to deny.
Outbound Access
Importing pre-built images from Turbo.net requires outbound HTTPS to https://hub.turbo.net, https://start.turbo.net, and https://start-c.turbo.net. Domains that serve only locally managed images do not require these endpoints for image import.
Load Balancing
Portal hosts scale horizontally behind an external load balancer. Per-user interface state lives on the host serving that user, so the load balancer requires session affinity. Without affinity, users can lose state when successive requests reach different Portal hosts. See Sizing and Capacity.