Dataflow workers exchange shuffle and control traffic over TCP ports 12345 and 12346. When firewall rules are defined by network tags, Google recommends verifying that a rule allows those ports for the Dataflow worker network tag (for example, the default dataflow tag or any custom tag applied to the job), which is the standard secure way to permit required worker-to-worker communication.