I have setup an elastic-search cluster with two data nodes, one master node and one client node with kibana. I was running it with iptables disabled on each node.

Now I need to enable iptables and I want to know which of the ports (9200 , 9300) I need to open on each node and in which direction (incoming or outgoing or both).

I also need to know on which node i need to place authentication , only the client node?

  • What version of Linux are you running? – Kevdog777 Jan 20 '16 at 11:29
  • It is CentOS 6 – Ijaz Ahmad Khan Jan 20 '16 at 11:34

Elasticsearch uses the following port ranges:

  • 9200-9300: Web API connectivity.
  • 9300-9400: Infra / Node communication

Between Elasticsearch Cluster nodes:

iptables -A INPUT -p tcp -s <source> --dport 9300:9400 -j ACCEPT

Between Master and Kibana (client > server):

iptables -A INPUT -p tcp -s <source> --dport 9200 -j ACCEPT

Elasticsearch uses by default UDP multicast to discover other nodes on the network to form a cluster. you can use the following rule to enable that

iptables -A INPUT -m pkttype --pkt-type multicast -j ACCEPT


Alternatively and a better option (larger clusters benefit more from this) is to minimize chatter from multicast by switching to unicast (note some cloud providers do not allow unicast)

Alternatively, you can also define your own configuration for port binding using Transport.

transport.profiles.default.port: 9300-9400
transport.profiles.client.port: 9500-9600
transport.profiles.dmz.port: 9700-9800

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.