Skip to main content
Orka reaches each Apple silicon VM through ports on its Mac node. When a VM deploys, Orka assigns it an SSH port and a Screen Sharing port on the node, plus a VNC console port if the VM’s VNC console is enabled. You connect to <NODE_IP>:<PORT>, and Orka forwards the traffic to the VM. This page applies to the default NAT network mode. With bridge networking, each VM has its own IP address, and you connect to SSH on port 22 and Screen Sharing on port 5900 of the VM’s IP. The VNC console still runs on the node: Orka assigns it a node port starting at 5999, counted across the cluster as described below, so allow 5999 to 5998 + 2N to your Apple silicon nodes if you enable it.

​
How Orka assigns ports

For each new VM, Orka starts at the first port and counts up until it finds a port that no other Apple silicon VM in the cluster is using. The assignment is cluster-wide: two VMs never share a port number, even on different nodes. When a VM is deleted, its ports become free and Orka can assign them to the next VM. Each Apple silicon node runs at most 2 VMs, but because the count runs across the whole cluster, the ports a VM gets depend on how many VMs are running on all nodes when it deploys. For example, an SSH port of 8844 means about 22 other VMs were running in the cluster at the time, spread across at least 11 nodes. To see a VM’s ports, run:
Ports that you map yourself with orka vm deploy --ports <NODE_PORT>:<VM_PORT> use the node port you choose. Allow those ports separately.

​
Ports to allow in your firewall

Allow these TCP ranges from the networks that need to reach your VMs, to every Apple silicon node in the cluster. The ranges below cover about 300 VMs running at the same time, or about 150 Apple silicon nodes at 2 VMs each: To size the ranges for your own cluster, where N is the number of Apple silicon nodes:
  • SSH: 8822 to 8821 + 2N.
  • Screen Sharing: 5901 to 5900 + 2N.
  • Screen Sharing and VNC console: 5901 to 5998 + 2N for up to 49 nodes, and 5901 to 5900 + 4N above that. Both draw from the same free ports. Screen Sharing counts up from 5901 and the VNC console from 5999, so once about 98 VMs are running, the two interleave and share one block.
Orka doesn’t stop at the end of a range. When you add nodes, each node raises the upper bound by 2 ports (4 with the VNC console), so widen your firewall rules to match, or allow extra headroom up front. You don’t need firewall rules for Android emulators. An emulator’s relay port is reachable only from macOS VMs on the same node. For the other rules Orka needs, see Orka required URL rules for filtering.