Vault cluster network port reference
Vault requires certain ports open for you or your workloads to connect to a Vault cluster. Depending on your specific configuration, you may need additional ports opened both inbound and outbound.
Refer to the core cluster table for the required ports. Open additional ports from the supporting tables that match your actual deployment (storage backend, plugins, auth methods, secrets engines). Don't open ports for components you don't run.
Where you run Vault determines whether you need inbound, outbound, or both. Verify how your specific platform (AWS, Azure, Kuberenetes, Nomad) handle traffic.
Security groups (AWS/Azure/GCP) are stateful: ingress-only rules are sufficient; return traffic is automatic.
NACLs are stateless (Physicaal network switch): you need explicit rules in both directions, plus your ephemeral port range (1024–65535) for return traffic.
Core cluster
| Port | Protocol | Direction | Source → Destination | Purpose |
|---|---|---|---|---|
| 8200 | TCP | Inbound | Clients/admin → Load balancer | Request distribution |
| 8200 | TCP | Inbound | Load balancer → Vault servers | Vault API (api_addr) |
| 8200 | TCP | Bidirectional | Vault servers ↔ Vault servers | Cluster bootstrapping |
| 8201 | TCP | Bidirectional | Vault servers ↔ Vault servers | Raft, replication, request forwarding (cluster_addr) |
| 8200 + 8201 | TCP | Bidirectional | Primary cluster ↔ DR secondary cluster | DR / Performance Replication traffic |
Storage backend
| Port | Protocol | Direction | Source → Destination | Purpose |
|---|---|---|---|---|
| 8201 | TCP | — | — | Integrated Storage (Raft): no extra port, uses 8201 only |
| 8300 | TCP | Bidirectional | Consul servers ↔ Consul servers | Consul server RPC |
| 8301 | TCP + UDP | Bidirectional | Consul agents ↔ Consul agents | Consul LAN gossip |
| 8302 | TCP + UDP | Bidirectional | Consul servers ↔ Consul servers | Consul WAN gossip (multi-DC only) |
| 8500 (or 8501 w/ TLS) | TCP | Outbound | Vault servers → Consul | Consul HTTP(S) API |
| 8600 | TCP + UDP | Outbound | Vault servers → Consul | Consul DNS interface (optional) |
| 443 | TCP | Outbound | Vault servers → Cloud storage API | Cloud-native backends (S3, DynamoDB, Azure Blob, GCS), no listener port |
Plugins with a dedicated listener
| Port | Protocol | Direction | Source → Destination | Purpose |
|---|---|---|---|---|
| 5696 | TCP | Inbound | KMIP clients → Vault servers | KMIP secrets engine listener; default listen_addrs, rebind and open separately from 8200/8201 |
| — | — | — | — | PKI / SCEP / OCSP / CRL served over 8200 unless fronted by an external URL/CDN |
| — | — | — | — | Vault Agent / Proxy no default listener, only opens a port if you configure one |
Auto-unseal / seal wrap
| Port | Protocol | Direction | Source → Destination | Purpose |
|---|---|---|---|---|
| 443 | TCP | Outbound | Vault servers → Cloud KMS | AWS KMS / Azure Key Vault / GCP Cloud KMS |
| Vendor-specific | TCP | Outbound | Vault servers → HSM | PKCS#11 network HSM (e.g., Luna ~1792) — check vendor docs |
Auth methods
| Port | Protocol | Direction | Source → Destination | Purpose |
|---|---|---|---|---|
| 443 | TCP | Outbound | Vault servers → Identity provider | Okta, Azure AD/Entra, AWS IAM/STS, GCP IAM, JWT/OIDC, GitHub |
| 389 / 636 | TCP | Outbound | Vault servers → LDAP server | LDAP / LDAPS |
| 1812 | UDP | Outbound | Vault servers → RADIUS server | RADIUS |
| 88 | TCP + UDP | Outbound | Vault servers → KDC | Kerberos |
Secrets engines
This is a list of common platforms to integrate with Vault secrets engines. Verify the exact port number with your provider or your specific configuration (e.g. 636 for LDAPS vs 389 for LDAP)
| Port | Protocol | Direction | Source → Destination | Purpose |
|---|---|---|---|---|
| 443 | TCP | Outbound | Vault servers → Cloud API | AWS, Azure, GCP secrets engines |
| 5432 | TCP | Outbound | Vault servers → Database | PostgreSQL |
| 3306 | TCP | Outbound | Vault servers → Database | MySQL / MariaDB |
| 1433 | TCP | Outbound | Vault servers → Database | MSSQL |
| 1521 | TCP | Outbound | Vault servers → Database | Oracle |
| 27017 | TCP | Outbound | Vault servers → Database | MongoDB |
| 9042 | TCP | Outbound | Vault servers → Database | Cassandra |
| 389 | TCP | Outbound | Vault servers → LDAP | LDAP secrets engine |
| 22 | TCP | Outbound | Vault servers → Target host | SSH secrets engine |
Telemetry / audit
| Port | Protocol | Direction | Source → Destination | Purpose |
|---|---|---|---|---|
| — | — | — | — | Prometheus scrape served over 8200's /v1/sys/metrics, no separate port |
| 8125 | UDP | Outbound | Vault servers → StatsD collector | StatsD telemetry, if statsd_address is set |
| Configurable | TCP/UDP | Outbound | Vault servers → Audit destination | Socket audit device, address set explicitly when enabled |
| 514 | TCP/UDP | Outbound | Vault servers → Syslog server | Remote syslog forwarding, if used |