Ports and protocols
The network ports that a Citrix SecurSpaces™ deployment exposes, for firewall rules and network security review.
This page covers deployments to a Kubernetes cluster. For the ports a 1-Click VM evaluation environment needs, see Deploy in the cloud.
Externally exposed ports
These are the only ports that need to reach the cluster from your network.
| Port | Protocol | Purpose |
|---|---|---|
| 443 | HTTPS | The SecurSpaces console, the API, and workspace applications served through the proxy host name |
| 80 | HTTP | Redirects to HTTPS |
| Your choice, commonly 22 | TCP, carrying SSH | Remote development over SSH. Forwarded by the ingress controller to the workspace API. |
TLS is terminated at the ingress controller. The permitted TLS versions and cipher suites are therefore set by your ingress configuration, not by SecurSpaces.
SSH port forwarding
SecurSpaces does not fix the external SSH port. You choose it when you configure TCP forwarding on the ingress controller, and the ingress forwards it to port
2222 on the workspace API.
| Side | Port |
|---|---|
| External | Whatever you configure on the ingress controller. Commonly 22. |
| Internal, on the workspace API | 2222 |
Important:
Port
2222 is hardcoded in the workspace API. Do not change it.
For the configuration steps, see Enable SSH access to workspaces.
Internal service ports
SecurSpaces services communicate over additional ports inside the cluster, including gRPC and HTTP ports on the central, coordinator, monitor, workspace, and proxy services. These are cluster-internal. They do not need to be reachable from outside the cluster, and you can restrict them with Kubernetes Network Policies.
For how SecurSpaces uses network policies to control workspace traffic, see Network policies.