Ports

Every well-known port in the system, in one table. The short version: nothing you run at home listens on the network. The gateway and CLI only dial out (WSS to a relay), the gateway's console binds loopback only, and the only component that opens public ports is a relay — the system relay fleet, or an edge you host yourself.

Port	Component	Bind	Purpose
443/tcp	Relay (system + edge)	public	The WSS endpoints everything dials — gateways, clients, and the relay's own links up to the console. On an edge this is the tls_listen listener, default :443, settable or off for a LAN-only edge. With the nginx front installed, nginx owns :443 and passes through.
443/udp (QUIC)	Relay (system + edge)	public, optional	The QUIC transport on the system relay fleet. On an edge, QUIC has no default — it is off unless quic_addr is set in ~/.burrowee/edge/config (or --quic-addr), and it binds exactly the address you give; nginx does not front it.
16518/tcp	Gateway	127.0.0.1 only	The local console — the gateway's web UI + JSON API. Never reachable from the network; disable with --console off.
8448/tcp	Edge	LAN interfaces	The nginx LAN TLS front (nginx --listen-lan, default 8448). Terminates the pinned LAN cert and proxies to the edge's loopback listener below. This is the port advertised in LAN endpoints.
9448/tcp	Edge	127.0.0.1 only	The edge's plain-WS LAN listener (lan_listen, default 127.0.0.1:9448) — only ever reached through the nginx front on 8448.
operator-set, off by default	Edge	public (bypasses nginx)	The edge-to-edge bridging raw listener (raw_port in ~/.burrowee/edge/config, or edge cli bridge raw-port <port>) — serves the same relay service on a dedicated port nginx never fronts, so isolated carriers between bridged edges aren't double-handled by the reverse proxy. Unset (off) keeps an edge byte-identical to one with no bridging configured.
ephemeral	CLI	127.0.0.1:0	The local forward listener connect/ssh opens for each tunnel (--local to pin one). ssh always uses an ephemeral loopback port.

Unix sockets (not TCP, listed for completeness)

Socket	Component	Purpose
~/.burrowee/cli/sockets/transport.sock	CLI daemon	Transport IPC — stream consumers, plus every relays/gateways subcommand that mutates or needs a live answer (use, rm, pair, resync, probe, ping, …). Not used by the list forms or routes, which read config.json directly
~/.burrowee/gateway/sockets/register.sock	Gateway	burrowee-register registers local services
~/.burrowee/gateway/sockets/console.sock	Gateway	The separate burrowee-gateway-console process triggers key/carrier operations on the daemon over this socket

Each lives under its component home (~/.burrowee/<cli\|gateway>/sockets/). On a pathologically long home path the transport socket overflows to $XDG_RUNTIME_DIR/burrowee/transport.sock (OS temp dir when XDG_RUNTIME_DIR is unset) and the register socket to the fixed path /usr/local/var/burrowee/gateway/sockets/register.sock. Paths and overrides: Config homes & files.

What dials what

Outbound-only summary — useful for firewall rules:

From	To	Protocol
CLI	relay :443 (and QUIC if configured); LAN-published edge origins first when present	WSS / QUIC
Gateway	every configured relay :443	WSS
Edge	the Burrowee console (compiled-in host)	WSS + HTTPS
Gateway → local service	e.g. 127.0.0.1:22 on the gateway host	plain TCP (the target you exposed)