Cribl Stream requires certain ports to be open, and additional ports are needed if you intend to use specific integrations or options to work.

Leader

​

In a Distributed deployment, the following ports must be open on the Leader Node. Ensure that the Leader is reachable on those ports from all Workers.

In High Availability Leader proxy mode, UI/API traffic on port 9000 can be routed to either Leader; the standby transparently proxies requests to the elected primary Leader. For details, see Active-Active (Proxy) Mode for HA Leaders.

If you want to use proxy for communication between Leader and Worker Nodes, use SOCKS proxy instead of HTTP/S. You need to use SOCKS proxy, because HTTP/S proxies typically don’t support raw TCP sockets that Leader-Worker communication uses.

External Notification targets: If you configure external Notification targets (for example, email, PagerDuty, webhooks, Slack, or AWS SNS), the Leader must be able to initiate outbound network connections to those services. Ensure your firewall rules allow outbound traffic from the Leader to each target endpoint over the ports and protocols required by that service (commonly HTTPS/443, or SMTP ports for email). Because these ports are target-specific, they are not listed individually here.

Outpost

​

The following port is used by Cribl Outpost.

Workers

​

The following ports are used by Worker Nodes.

Other Ports

​

This section lists port allocations for specific transport protocols and other special purposes.

Common Ports

​

Integrations and Apps

​

Integrations with specific services, via Sources and Destinations or apps, might require opening dedicated ports on Worker Nodes.

The defaults are listed below. When configuring most Sources or Destinations, you can choose a different port. However, on hybrid Worker Groups that you manage, the Cribl Lake Destination is hard-coded to send outbound HTTP/S traffic through port 443.

Cribl.Cloud Ports

​

Cribl.Cloud provides a set of ports linked to Sources enabled by default for your Workspace. To view them:

1. From your Cribl.Cloud Organization’s top bar, select Products.
2. Then from the sidebar, select Cribl > Workspace, and then Data Sources.

Additionally, Cribl.Cloud makes the 20000 - 20010 port range available for configuring other Sources.

Reusing Port 443 for Other Services

​

External port 443 is transparently mapped by the load balancer to internal port 10443 on the Worker Group. While this port is pre-configured for Amazon Data Firehose by default, you can reuse it for other TCP-based services that require port 443 (such as DocuSign).

To use port 443 for a different service:

1. Configure a Source to listen on port 10443 internally.
2. External clients connect to your Cribl.Cloud endpoint on port 443, which the load balancer routes to port 10443 on the Worker.

If you’re already using Amazon Data Firehose on this port, you can still receive data from other services by differentiating traffic using a pre-processing Pipeline. For example, check for the presence of __firehose* fields or inspect __headers to identify the data Source.

No other custom ports can be opened for Cribl-managed Worker Groups in Cribl.Cloud beyond port 443 and ports 20000-20010.

Cribl Copilot Port

​

To use Cribl Copilot, your Cribl Stream deployment must be able to establish a connection to ai.cribl.cloud on port 443.

Overriding Default Ports

​

You can override the Cribl Stream UI port (9000), as well as other settings, in the $CRIBL_HOME/local/cribl/cribl.yml configuration file.

The defaults are stored in $CRIBL_HOME/default/cribl/cribl.yml.