> ## Documentation Index > Fetch the complete documentation index at: https://docs.macstadium.com/llms.txt > Use this file to discover all available pages before exploring further. # VM access ports > How Orka assigns SSH, Screen Sharing, and VNC ports to Apple silicon VMs, and which port ranges to allow in your firewall. Orka reaches each Apple silicon VM through ports on its Mac node. When a VM deploys, Orka assigns it an SSH port and a Screen Sharing port on the node, plus a VNC console port if the VM's VNC console is enabled. You connect to `:`, and Orka forwards the traffic to the VM. This page applies to the default NAT network mode. With [bridge networking](https://docs.macstadium.com/orka/orka-on-aws-and-on-prem/using-bridge-networking-with-orka-350.md), each VM has its own IP address, and you connect to SSH on port 22 and Screen Sharing on port 5900 of the VM's IP. The VNC console still runs on the node: Orka assigns it a node port starting at 5999, counted across the cluster as described below, so allow 5999 to 5998 + 2N to your Apple silicon nodes if you enable it. ## How Orka assigns ports | Port | First port Orka assigns | Forwards to the VM's | | - | - | - | | SSH | 8822 | port 22 | | Screen Sharing | 5901 | port 5900 | | VNC console | 5999 | VNC console | For each new VM, Orka starts at the first port and counts up until it finds a port that no other Apple silicon VM in the cluster is using. The assignment is cluster-wide: two VMs never share a port number, even on different nodes. When a VM is deleted, its ports become free and Orka can assign them to the next VM. Each Apple silicon node runs at most 2 VMs, but because the count runs across the whole cluster, the ports a VM gets depend on how many VMs are running on all nodes when it deploys. For example, an SSH port of 8844 means about 22 other VMs were running in the cluster at the time, spread across at least 11 nodes. To see a VM's ports, run: ```bash theme={null} orka vm list ``` Ports that you map yourself with `orka vm deploy --ports :` use the node port you choose. Allow those ports separately. ## Ports to allow in your firewall Allow these TCP ranges from the networks that need to reach your VMs, to every Apple silicon node in the cluster. The ranges below cover about 300 VMs running at the same time, or about 150 Apple silicon nodes at 2 VMs each: | Port | Range to allow | | - | - | | SSH | 8822-9122 | | Screen Sharing, without the VNC console | 5900-6200 | | Screen Sharing and VNC console | 5900-6500 | To size the ranges for your own cluster, where N is the number of Apple silicon nodes: * **SSH:** 8822 to 8821 + 2N. * **Screen Sharing:** 5901 to 5900 + 2N. * **Screen Sharing and VNC console:** 5901 to 5998 + 2N for up to 49 nodes, and 5901 to 5900 + 4N above that. Both draw from the same free ports. Screen Sharing counts up from 5901 and the VNC console from 5999, so once about 98 VMs are running, the two interleave and share one block. | Apple silicon nodes | Max VMs | SSH | Screen Sharing | Screen Sharing and VNC console | | - | - | - | - | - | | 10 | 20 | 8822-8841 | 5901-5920 | 5901-6018 | | 25 | 50 | 8822-8871 | 5901-5950 | 5901-6048 | | 50 | 100 | 8822-8921 | 5901-6000 | 5901-6100 | | 100 | 200 | 8822-9021 | 5901-6100 | 5901-6300 | | 150 | 300 | 8822-9121 | 5901-6200 | 5901-6500 | Orka doesn't stop at the end of a range. When you add nodes, each node raises the upper bound by 2 ports (4 with the VNC console), so widen your firewall rules to match, or allow extra headroom up front. You don't need firewall rules for [Android emulators](https://docs.macstadium.com/orka/orka-resources/android-emulators.md). An emulator's relay port is reachable only from macOS VMs on the same node. For the other rules Orka needs, see [Orka required URL rules for filtering](https://docs.macstadium.com/orka/orka-resources/orka-required-url-rules-for-filtering.md). ## Related topics - [Orka on AWS architecture and deployment overview](https://docs.macstadium.com/orka/orka-on-aws-and-on-prem/orka-on-aws-getting-started.md) - [Orka On-Prem architecture and networking overview](https://docs.macstadium.com/orka/orka-on-aws-and-on-prem/orka-on-prem-getting-started.md) - [Orka Required URL Rules for Filtering](https://docs.macstadium.com/orka/orka-resources/orka-required-url-rules-for-filtering.md) - [Managing your Orka license](https://docs.macstadium.com/orka/orka-engine/managing-your-orka-license.md) - [Access Orka on AWS in a private VPC with SSM](https://docs.macstadium.com/orka/orka-on-aws-and-on-prem/orka-on-aws-vpc-access.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.