Xandeum pNode Network Port Requirements

This page lists the current network ports and firewall checks required or recommended for Xandeum pNode operation.

These examples are based on Ubuntu 24.04 LTS with UFW on a VPS. If you use a different setup, adjust the commands while preserving the required ports, protocols, and traffic direction.

Please note that this guide focuses specifically on Xandeum pNode network requirements, not full VPS administration. The examples below are intended to help operators confirm the required ports and firewall posture for pNode operation. Operators remain responsible for their own server configuration, security, maintenance, backups, recovery access, and any other services they choose to run on the same VPS.

Xandeum defines these requirements because insecure, unreachable, or misconfigured pNodes can affect pNode reliability, network security, network integrity, and reward-related operation.

This guide covers:

This guide does not cover:

The examples in this guide are based on Ubuntu 24.04 LTS with UFW.

Check the operating system before applying firewall changes:

If the VPS is not running Ubuntu 24.04 LTS, review the relevant setup requirements for your operating system and firewall tool before continuing.

The current Xandeum pNode network profile is:

The SSH port is usually 22, unless the operator has intentionally configured a different SSH port.

Purpose labels are descriptive operational labels. If more precise service names are confirmed later, this table should be updated.

Firewall changes can interrupt access to a VPS if SSH access is not preserved.

Before making changes:

Check the current UFW state:

sudo ufw status verbose is preferred because it shows both active rules and default policies, such as deny incoming and allow outgoing.

These commands are examples. Operators should review their current firewall state before applying changes, especially if the VPS also runs monitoring, dashboards, backup agents, support tooling, or other non-Xandeum services.

Show current UFW status first:

Add SSH rate limiting for the active SSH port before enabling or tightening firewall rules.

For the default SSH port:

If SSH has intentionally been moved to another port, replace 22 with the active SSH port. For example:

Allow the current Xandeum pNode ports:

9001/udp and 7000/tcp are listed twice because they are inbound and outbound requirements. In UFW, inbound and outbound rules are separate. For example, sudo ufw allow 7000/tcp allows inbound traffic to local port 7000; sudo ufw allow out 7000/tcp allows outbound traffic to destination port 7000.

7001/udp and 7002/udp are different because they have different directions in the current profile: 7001/udp is outbound pod-to-pod fanout, while 7002/udp is inbound pod-to-pod fanout.

If your firewall uses the common default policy of allowing outgoing traffic, explicit outbound rules may already be covered. They are still shown here to document the full Xandeum traffic profile, especially for operators using stricter outbound policies.

Many operators use a default-deny inbound firewall policy, then explicitly allow only the inbound services they need:

These default-policy commands do not delete existing UFW allow rules. If the Xandeum allow rules already exist, running these default-policy commands afterwards should not remove or disable those specific rules.

However, default policies affect traffic that does not match an explicit rule. Before setting or changing default policies, make sure SSH and any other required services have explicit allow or limit rules.

For example, default deny incoming is safe for Xandeum port 7000/tcp only if the inbound 7000/tcp allow rule exists. Similarly, default allow outgoing allows outbound traffic generally; explicit outbound rules for 9001/udp, 7000/tcp, and 7001/udp document the Xandeum profile and remain useful for stricter firewall setups.

Enable UFW only after confirming SSH will remain accessible:

Port 7000/tcp is part of the current Xandeum pNode network profile for Ingest/Tap traffic.

Some VPS setups may also have pod-manager installed. If both pod and pod-manager are configured to use port 7000 on the same VPS, one service may fail to start or may prevent the other service from binding to the port correctly.

Before changing firewall rules, check what is listening on port 7000:

If pod-manager is using port 7000, move the pod-manager server port to another unused local port, such as 7100, so that pod can use port 7000.

The pod-manager configuration is commonly located at:

Preserve the existing JSON structure and change only the configured server or listen port. The exact key name may vary by installed pod-manager version.

After changing the configuration, restart pod-manager and confirm it is running:

Then check port 7000 again:

If pod does not automatically take port 7000, restart the relevant pod service according to the pNode setup used for that installation.

Do not add the replacement pod-manager port, such as 7100, to the public firewall profile unless your setup specifically requires external access to it. In many cases, a management port should remain local or be accessed through a controlled method such as SSH.

Moving SSH away from port 22 is optional. It may reduce generic port-22 scan noise and log clutter, but it should not be presented as meaningful security hardening by itself.

It does not replace maintaining reliable SSH access, using appropriate authentication settings, applying firewall rate limiting, or keeping recovery access available.

UFW rate limiting helps reduce repeated SSH connection attempts from the same IP address. It does not inspect SSH login failures, usernames, passwords, or keys. It limits repeated connection attempts at the firewall level.

This can help reduce noisy brute-force and bot activity, but it is not a full SSH security solution by itself.

Do not use ufw --force reset as a normal public operator instruction.

A reset can remove rules that the operator relies on for SSH, monitoring, backups, dashboards, support access, or other services. Even with rollback instructions, a reset can still cause lockout or downtime if SSH access is interrupted before the operator can recover.

The safer default is:

After applying changes, review the active firewall state:

Expected Xandeum-related rules should include:

IPv6 entries may also appear if IPv6 is enabled in UFW.

These are the current network ports and baseline firewall checks required or recommended for Xandeum pNode operation. VPS administration remains the responsibility of the operator.

Operators should ensure their firewall policy does not break SSH access, hosting-provider access, monitoring, backups, or any other services they intentionally run on the VPS.

Before making firewall changes, confirm that you can access your hosting-provider dashboard and that your account recovery details are current. If your provider supports snapshots or backups, take a fresh snapshot or backup before making significant firewall changes.

Xandeum may use internal helper tools for development, support, or diagnostics. Those tools are not part of this public guide. Operators should follow the port matrix and example commands above, and should review any firewall change before applying it to their own VPS.