Requirements and Ports for MATLAB Parallel Server

This section discusses the requirements and port configuration for your network to support parallel computing.

Fully Qualified Domain Names

MATLAB^® Parallel Server™ software and Parallel Computing Toolbox™ software support both short host names and fully qualified domain names. The default usage is short host names. Check the following considerations depending on your scheduler type:

Scheduler	Consideration
MATLAB Job Scheduler	If your network requires fully qualified host names, you can use the `mjs_def` file to identify the worker nodes by their full names. See Define MATLAB Job Scheduler Startup Parameters. To set the host name used for a MATLAB client session, see the `pctconfig` (Parallel Computing Toolbox) reference page.
Third-Party scheduler	To set the host name used for a MATLAB client session, see the `pctconfig` (Parallel Computing Toolbox) reference page.

Security Considerations

Check the following table for security considerations when using MATLAB Parallel Server:

Scheduler Security Consideration

MATLAB Job Scheduler

Scheduler	Security Consideration
MATLAB Job Scheduler	MATLAB workers run as whatever user the administrator starts the node’s `mjs` service under. By default, the `mjs` service starts as `root` on UNIX^® operating systems, and as `LocalSystem` on Microsoft^® Windows^® operating systems. Because MATLAB provides system calls, users can submit jobs that execute shell commands. If you want to run tasks as the user that submitted the job, use security level 3. For more information, see Set Security Level. By default, the `mjs` service does not enforce any access control or authentication. Anyone with local or remote access to the `mjs` services can start and stop their workers and job managers, and query for their status. For authentication and access control options, see Set MATLAB Job Scheduler Cluster Security. By default, the job manager does not restrict access to the cluster, nor to job and task data. For information on security options, see Set MATLAB Job Scheduler Cluster Security. Using a third-party scheduler instead of the MathWorks^® job manager could allow you to take advantage of the security measures it provides. The parallel computing processes must all be on the same side of a firewall, or you must take measures to enable them to communicate with each other through the firewall. Workers running tasks of the same communicating job cannot be separated by a firewall, because their MPI-based communication will not work. If certain ports are restricted, you can specify the ports used for parallel computing. For details, see Required Ports. If your organization is a member of the Internet Multicast Backbone (MBone), make sure that your parallel computing cluster is isolated from MBone access if you are using multicast for parallel computing. Isolation is generally the default condition. If you have any questions about MBone membership, contact your network administrator. You can use a SOCKS5 Proxy to add mutual‑TLS client authentication and end‑to‑end encryption between MATLAB clients and the cluster. For details, see Configure SOCKS5 Proxy for MATLAB Job Scheduler. (since R2026a)
Third-Party scheduler	The parallel computing processes must all be on the same side of a firewall, or you must take measures to enable them to communicate with each other through the firewall. Workers running tasks of the same communicating job cannot be separated by a firewall, because their MPI-based communication will not work. If users will schedule communicating jobs on the cluster, each cluster host participating in communicating jobs requires unchallenged SSH. For example, to enable unchallenged SSH the cluster admin can set up host based authentication/host based authorization for approved cluster users.

MATLAB workers run as whatever user the administrator starts the node’s mjs service under. By default, the mjs service starts as root on UNIX^® operating systems, and as LocalSystem on Microsoft^® Windows^® operating systems. Because MATLAB provides system calls, users can submit jobs that execute shell commands. If you want to run tasks as the user that submitted the job, use security level 3. For more information, see Set Security Level.
By default, the mjs service does not enforce any access control or authentication. Anyone with local or remote access to the mjs services can start and stop their workers and job managers, and query for their status. For authentication and access control options, see Set MATLAB Job Scheduler Cluster Security.
By default, the job manager does not restrict access to the cluster, nor to job and task data. For information on security options, see Set MATLAB Job Scheduler Cluster Security. Using a third-party scheduler instead of the MathWorks^® job manager could allow you to take advantage of the security measures it provides.
The parallel computing processes must all be on the same side of a firewall, or you must take measures to enable them to communicate with each other through the firewall. Workers running tasks of the same communicating job cannot be separated by a firewall, because their MPI-based communication will not work.
If certain ports are restricted, you can specify the ports used for parallel computing. For details, see Required Ports.
If your organization is a member of the Internet Multicast Backbone (MBone), make sure that your parallel computing cluster is isolated from MBone access if you are using multicast for parallel computing. Isolation is generally the default condition. If you have any questions about MBone membership, contact your network administrator.
You can use a SOCKS5 Proxy to add mutual‑TLS client authentication and end‑to‑end encryption between MATLAB clients and the cluster. For details, see Configure SOCKS5 Proxy for MATLAB Job Scheduler. (since R2026a)

Third-Party scheduler

The parallel computing processes must all be on the same side of a firewall, or you must take measures to enable them to communicate with each other through the firewall. Workers running tasks of the same communicating job cannot be separated by a firewall, because their MPI-based communication will not work.
If users will schedule communicating jobs on the cluster, each cluster host participating in communicating jobs requires unchallenged SSH. For example, to enable unchallenged SSH the cluster admin can set up host based authentication/host based authorization for approved cluster users.

Required Ports

Before you can use MATLAB Parallel Server, you must configure certain required ports. If you need more help during configuration, see this information from MathWorks Support Team on MATLAB Answers: MATLAB Job Scheduler, or Third-Party Scheduler.

For MATLAB Job Scheduler

BASE_PORT. The mjs_def file specifies and describes the ports required by the job manager and all workers. For more information, see the description for the BASE_PORT parameter in Define MATLAB Job Scheduler Startup Parameters.

Communicating Jobs. On worker machines running a UNIX operating system, the number of ports required by MPICH for the running of communicating jobs ranges from BASE_PORT + 1000 to BASE_PORT + 2000.

SOCKS5 Proxy for MATLAB Job Scheduler. You can route all Parallel Computing Toolbox client traffic to a MATLAB Job Scheduler cluster through a single SOCKS5 proxy endpoint using the parallelserverproxy tool. This reduces the number of open client‑to‑cluster ports and simplifies firewall rules. The proxy also authenticates clients with mutual TLS and encrypts all communication. (since R2026a)

To learn more, see Configure SOCKS5 Proxy for MATLAB Job Scheduler.

With Third-Party Scheduler

Communication Between Workers. Before the worker processes start, you can control the port range the workers use for communicating jobs.

For Microsoft HPC Pack clusters, define the environment variable MPICH_PORT_RANGE with the value minport:maxport.
For all other third-party schedulers, define the minimum port number using the FI_TCP_PORT_LOW_RANGE environment variable and the maximum port number using the FI_TCP_PORT_HIGH_RANGE environment variable.
Before R2024b: You can control the range of ports used by the workers for communicating jobs by defining the environment variable MPICH_PORT_RANGE with the value minport:maxport.

Open Ports on Workers for Inbound Communication from Client. You can control the listening port range workers open to connect to clients for interactive parallel pool jobs.

Use the pctconfig (Parallel Computing Toolbox) function to specify which listening ports workers must open or
Define the environment variable PARALLEL_SERVER_OVERRIDE_PORT_RANGE with the value "minport maxport". This will override the port range specified with pctconfig.
- For Microsoft HPC Pack, set PARALLEL_SERVER_OVERRIDE_PORT_RANGE in the job template with an addition to the Environments field. For example, to open a listening port in the range 30000 to 31000, add this code to the job template.
```
PARALLEL_SERVER_OVERRIDE_PORT_RANGE=30000 31000; 
```
- For other third-party schedulers, set PARALLEL_SERVER_OVERRIDE_PORT_RANGE in the communicatingJobWrapper.sh script. For example, to open a listening port in the range 29000 to 31000, add this code to the communicatingJobWrapper.sh script.
```
export PARALLEL_SERVER_OVERRIDE_PORT_RANGE="29000 31000"
```
  To learn more about the communicatingJobWrapper.sh script, see Wrapper Scripts.