Skip to content

Network Exposure

Which ports on the MetaMiner Server host must be reachable from where, which services stay local, and how to set firewall rules.

How it works

Users reach MetaMiner through one port: the MetaMiner Server (MMS) port, 49714 by default. The MetaMiner Client (MMC), the web console and Meta Query on the web all use it. The other MetaMiner services on the host are internal and serve the MMS.

flowchart LR
  subgraph Users
    MMC[MetaMiner Client]
    BR[Browser]
  end
  AG[Host agent on BO hosts] -->|49714| MMS
  MMC -->|49714| MMS
  BR -->|49714| MMS
  subgraph Host[MetaMiner Server host]
    MMS[MetaMiner Server]
    WA[Web Apps 49717 local]
    DB[(Embedded MMDB 49614)]
  end
  MMS --> WA
  MMS --> DB
  RT[Approved reporting hosts] -->|49614| DB
  MMS -->|6400, request ports| BO[BusinessObjects servers]
  MMS -->|6405 HTTPS| WACS[BO RESTful web service]

Inbound to the MetaMiner Server host

Port Service Allow from Notes
TCP 49714 MetaMiner Server (metaminer) MMC users' networks; BusinessObjects hosts running the host agent; administrators' browsers The only port users need. Change it in Preferences > Settings > General > Server Port. Turn on SSL
UDP 49352, 54215, 58632, 63759 MetaMiner Server discovery (multicast group 228.5.6.7) MMC users on the same LAN, optional Lets the MMC find servers automatically. Without it, users type the server name
TCP 49614 Embedded MMDB (InfolytikPostgres) Only hosts you approve for direct database access Not needed by MMC users. Restrict also in pg_hba.conf (MetaMiner Database SSL)
TCP 49717 Web Apps (MetaMinerWebApps) Nobody Answers local requests only. Browsers reach the web apps through port 49714
TCP 3000 Pulse dashboards (Grafana), when Pulse is on Administrators who use Pulse See Pulse Monitoring

TODO: confirm the Pulse dashboard bind address and whether port 3000 is reachable remotely by default

Source to check: Grafana configuration written by the MetaMiner Server (grafana.port, default 3000).

TODO: confirm whether the host agent can report over HTTPS

The host agent reports to the MMS port. Confirm it works when MetaMiner Server SSL is on.

Services that stay local

These serve only programs on the server itself. Do not open them in the firewall.

Service Port Purpose
Web Apps 49717 Back end of the web console, reached through the MMS
InfluxDB (Pulse) 8086 Metrics store for Pulse
Database Console dynamic Browser-based MMDB console started from MMA, bound to 127.0.0.1

The installer reserves ports 49714, 49614, 49716 and 49717 so Windows does not assign them to other programs. If you change the MMS port, reserve the new port; see MetaMiner Server SSL.

Outbound from the MetaMiner Server host

Destination Port Purpose
BusinessObjects CMS 6400 (SAP default) BO SDK logon and queries
Other BusinessObjects servers Their request ports BO SDK calls to processing servers. Fix request port ranges in the CMC if a firewall sits between MetaMiner and BusinessObjects
BusinessObjects RESTful web service (WACS) 6405 (SAP default) or your HTTPS port Web Intelligence document reads and validation
Audit and CMS databases Database port Audit pulls and repository queries, when configured
External MMDB 5432 typical When the MMDB is not embedded
LDAP or Active Directory 389 or 636 Directory sign-in
Mail server Your SMTP port Notifications

MMC workstations also open the BI launch pad of each environment in the browser.

Steps: set firewall rules

  1. On the MetaMiner Server host, open Windows Defender Firewall with Advanced Security.

  2. Create an inbound rule for TCP 49714 limited to your user and BusinessObjects host subnets:

    Allow the MetaMiner Server port from approved subnets
    New-NetFirewallRule -DisplayName "MetaMiner Server 49714" -Direction Inbound -Protocol TCP `
  -LocalPort 49714 -RemoteAddress 10.20.0.0/16,10.30.5.0/24 -Action Allow

  3. If reporting hosts read the MMDB, create a rule for TCP 49614 limited to those hosts.

  4. Do not create rules for 49717 or 8086.
  5. Repeat the port 49714 rule on network firewalls between users and the server.

Verify

  1. From a user workstation: powershell Test-NetConnection <server> -Port 49714 returns TcpTestSucceeded : True.
  2. From the same workstation: Test-NetConnection <server> -Port 49717 and -Port 49614 return False (unless that workstation is an approved reporting host).

Next steps