Ports and firewall

Inbound — what Nexus listens on

Port	Protocol	Default	Purpose
8080	HTTP	open	Web interface, API and WebSocket, unencrypted.
8443	HTTPS	open	The same, encrypted.

Both serve the same thing — the operator runtime, the configuration interface, the API that Studio and Lens use, and the WebSocket that carries live tag values. There is no separate API or WebSocket port to open.

Change them under gateway in the configuration file:

json

{
  "gateway": {
    "port": 8080,
    "httpsPort": 8443,
    "bindAddress": "0.0.0.0"
  }
}

To serve HTTPS only, set gateway.httpDisable — see Certificates and HTTPS.

Moving to 443 on Linux

Ports below 1024 need a capability the service does not have by default. Add AmbientCapabilities=CAP_NET_BIND_SERVICE and the matching CapabilityBoundingSet to the unit. Do not run Nexus as root instead.

Outbound — what Nexus connects to

These depend on what you configure. Open them from Nexus towards the device, not the other way.

Port	Protocol	When
44818	EtherNet/IP	Allen-Bradley devices.
502	Modbus TCP	Modbus devices.
4840	OPC-UA	OPC-UA servers, unless the server uses another port.
62541	OPC-UA	Ignition's OPC-UA server, a common source.
25 / 465 / 587	SMTP	Emailing reports and notifications.
21 / 22	FTP / SFTP	Delivering rendered reports.

Serial Modbus (RTU) uses a COM or tty device, not a port.

Windows firewall rules

The installer creates rules for Nexus program on the Private and Domain profiles. Never Public.

They are scoped to the program rather than to a port number, so moving the Nexus to a different port does not silently break them — which naming a port would.

powershell

Get-NetFirewallRule -DisplayName 'Raylux*' |
    Select-Object DisplayName, Profile, Enabled, Action

To install without them, because your site manages its own firewall policy:

powershell

msiexec /i Raylux-<version>-x64.msi /qn RAYLUXFIREWALL=0

A "Public" network classification blocks Nexus

Windows classifies unrecognised networks as Public, and no rule is created for that profile — deliberately, because a Nexus instance should not become reachable because someone plugged into an unfamiliar network. If a Nexus instance is unreachable on a network that ought to work, check Get-NetConnectionProfile first.

Linux firewall

Nothing is opened for you:

bash

sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --permanent --add-port=8443/tcp
sudo firewall-cmd --reload

What to expose where

From	Needs	Notes
Operator browsers	8443 (or 8080)	HTTPS only, once you have a certificate.
Raylux Studio	8443 (or 8080)	Same ports as a browser.
Raylux Lens panels	8443 (or 8080)	Same.
The internet	nothing	Use a VPN. Do not publish a Nexus instance directly.

Ports and firewall ​

Inbound — what Nexus listens on ​

Outbound — what Nexus connects to ​

Windows firewall rules ​