Ports and firewall rules for a CE deployment
Every connection a Nutanix Community Edition deployment with CE Deployer makes, inside your network and to the internet. Switch off what you don't use; the diagram and the rules follow. Hover or select a component to see only its connections.
Swipe sideways to see the whole diagram.
What you use
Your addresses
Optional. Fill in any of these and the diagram and the rules use your own addresses. Several addresses can go in one field, separated by commas. Nothing you type leaves this browser.
Firewall rules
From cedeployer.io/network, 5 November 2026. All internet connections are outbound; nothing on the internet connects in.
| From | To | Port | What for | Feature | Source |
|---|
A rule for the CVMs means every CVM IP, the cluster IP of Prism Element and the iSCSI Data Services IP. One for Prism Central means the Prism Central VM IP and its cluster (virtual) IP. One for the AHV hosts means every host IP.
For internet rules, it's the host names that count: the addresses behind them (CloudFront, Akamai) change. The install targets and CE Deployer have to reach each other on port 8080 for the whole install.
Measured means seen on the wire during a real three node nested deployment, in a packet capture on every AHV host's uplink. App code and Nutanix docs mark the rules that come from the app's own behaviour or from Nutanix's documentation.