Networking in Konnect

Konnect deployments run in either managed or Hybrid Mode, which means there is a separate control plane attached to a data plane consisting of one or more data plane nodes. Konnect control planes and data plane nodes rely on specific ports and hostnames for secure communication and configuration. The following tables detail the required ports for cluster communication, audit logging, and the hostnames for connecting to regional control plane and telemetry endpoints.

The Konnect control plane uses the following ports:

Kong Gateway’s hosted control plane expects traffic on these ports, so they can’t be customized.

Note: If you can’t make outbound connections using port 443, you can use an existing proxy in your network to make the connection. See Use a forward proxy to secure communication across a firewall for details.

The proxy ports are the only ports that should be made available to your clients. Upstream services are accessible via the proxy interface and ports, so make sure that these values only grant the access level you require.

Your proxy will need rules added for any HTTP/HTTPS and TCP/TLS stream listeners that you configure. For example, if you want Kong Gateway to manage traffic on port 4242, your firewall must configure the Route to allow traffic on that port.

The following are the default proxy ports:

You can also proxy TCP/TLS streams, which is disabled by default. If you want to proxy this traffic, see stream_listen in the Kong configuration reference for more information about stream proxy listen options and how to enable it.

Depending on the regions your organization uses, you’ll need to add specific hostnames to an allowlist. Replace REGION with the region identifier for your geo. The specific hostnames depend on your runtime or application.

The following geographic regions and their hostname region identifiers are supported:

• AU (Australia): au
• EU (Europe): eu
• ME (Middle East): me
• IN (India): in
• SG (Singapore) (beta): sg
• US (United States): us

Important: Visit https://ip-addresses.origin.konghq.com/ip-addresses.json for a full list of regional and service ingress IPs. The ingressIPs section contains a list of all ingress IPs per geo and consolidated IPs per service.

To avoid coupling firewall rules to specific services or DNS suffixes (such as cp, tp), we recommend adding the values in the ingressIPs block for each region to an allowlist. This ensures your setup is more resilient to future infrastructure or DNS changes. You can also subscribe to https://ip-addresses.origin.konghq.com/rss for updates.

Shared hostnames

Allowlist the following hostnames for any runtime or application:

API Gateway hostnames in Konnect

In addition to the shared hostnames, add the following Kong Gateway hostnames to your firewall allowlist:

Event Gateway hostnames in Konnect

In addition to the shared hostnames, add the following Event Gateway hostnames to your firewall allowlist:

Mesh hostnames in Konnect

In addition to the shared hostnames, add the following Kong Mesh hostnames to your firewall allowlist:

Konnect application hostnames

In addition to the shared hostnames, add the following Konnect application hostnames to your firewall allowlist:

Org Admins can specify an IP address or a range of IP addresses that are allowed to connect to Konnect through its supported interfaces. This includes the UI, the Konnect APIs, the Admin API, decK, kongctl, and Terraform.

This IP allowlist applies to all Konnect communication that goes through the Admin API.

Important:

• If the source IP address you have added to an allowlist is no longer reachable and IP allowlist enforcement is enabled, access to Konnect will be blocked.
• If you’re configuring an IP allowlist for the first time, it takes effect immediately. If you’re editing existing IP allowlist values, the changes will take effect after five minutes.

To configure an IP allowlist for Konnect, send a PUT request to the /organizations/$ORG_ID/ip-allow-list endpoint:

curl -X PUT "https://global.api.konghq.com/v3/organizations/$ORG_ID/ip-allow-list" \
     --no-progress-meter --fail-with-body  \
     -H "Authorization: Bearer $KONNECT_TOKEN" \
     --json '{
       "enabled": true,
       "allowed_ips": [
         "192.168.1.1",
         "192.168.1.0/22"
       ]
     }'

You can also configure allowed IPs for your Dev Portals. For more information, see Specify IP addresses that can connect to your Dev Portal.