Ports and Network
Configure firewall rules, exposed ports, and SDK access addresses.
Deploy without a domain or SSL certificate
Allow the following inbound ports through your host firewall or cloud security group. Do not expose any other ports publicly.
| Module | Port | Description | Action |
|---|---|---|---|
| OpenIMServer | TCP 10001 | WebSocket messaging port, used by OpenIMClientSDK | Allow |
| OpenIMServer | TCP 10002 | REST APIs for users, friends, groups, and messages | Allow |
| OpenIMServer | TCP 10005 | MinIO object storage service | Allow |
| ChatServer | TCP 10008 | Application business APIs (user registration, login, etc.) | Allow |
| ChatServer | TCP 10009 | App Administrator APIs (statistics, account banning, etc.) | Allow |
| Web frontend (optional) | TCP 11001 | PC Web client, needed if performing browser-based verification | Allow as needed |
| Admin frontend (optional) | TCP 11002 | App Administrator management console | Allow as needed |
Initialize OpenIMClientSDK using direct IP endpoints:
apiAddr: http://your_server_ip:10002
wsAddr: ws://your_server_ip:10001Deploy with a domain and SSL certificate
Expose only the standard HTTPS port TCP 443 publicly. Restrict all internal service ports to private networks or localhost. Complete DNS domain resolution and host IP binding first, then follow Domain configuration to configure SSL certificates and reverse proxy routing.
Initialize OpenIMClientSDK using secure domain endpoints:
apiAddr: https://your_domain.com/api
wsAddr: wss://your_domain.com/msg_gatewayIf you intend to follow the browser-based verification steps in Deployment verification by accessing port 11001 directly, ensure that port is reachable. If you do not require web frontend verification, never expose ports 11001 or 11002 to the public internet.