Gateway network requirements
Outbound
Section titled “Outbound”A gateway must reach these directly: it can’t use a proxy yet.
| Destination | Port | Used for |
|---|---|---|
gateway.witinaai.com |
TCP 443 | The gateway’s connection to Witina. Everything between the gateway and Witina uses it. |
downloads.witinaai.com |
TCP 443 | Gateway updates, and the images and installers you download |
registry.witinaai.com, app.witinaai.com |
TCP 443 | Container gateways only: pulling the gateway image |
api.ui.com |
TCP 443 | UniFi Site Manager, and UniFi consoles reached through UniFi’s cloud |
sentry.witinaai.com |
TCP 443 | Crash reports |
time.cloudflare.com, nts.netnod.se |
TCP 4460, UDP 123 | Keeping the clock right (NTS) |
DNS servers come from DHCP.
The VPN
Section titled “The VPN”When the VPN is on at a gateway’s site, the gateway also sends UDP from its port 51820:
| Destination | Port | Used for |
|---|---|---|
stun.cloudflare.com, stun.l.google.com |
UDP 3478 and UDP 19302 | Finding the public address and port its tunnels leave from |
| Technicians’ computers | Any UDP port | The tunnels |
The gateway sends first, toward each technician’s addresses, and the tunnel comes back through the opening that makes in the site’s NAT, so you don’t forward a port. If the site’s firewall blocks outbound UDP, technicians can’t connect to that site.
Listening on the customer’s network
Section titled “Listening on the customer’s network”| Port | Used for | On by default |
|---|---|---|
| TCP 8080 | The gateway’s local page, where a new gateway is claimed with a provisioning token | Yes |
| UDP 5353 (mDNS) | Being found by Find it on this network | Yes |
| UDP 162 | Receiving SNMP traps | No |
| UDP 69, and one HTTP port | Serving a configuration to a device during a restore | Only during a restore |
| UDP 51820 | VPN tunnels, through the opening the gateway makes | Only while the VPN is on |
| UDP and TCP 53, inside the tunnels only | DNS for technicians connected through the VPN | Only while the VPN is on |
Nothing on the internet connects in to a gateway.
Reaching devices
Section titled “Reaching devices”| Protocol | Default port |
|---|---|
| SNMP (v1, v2c, v3) | UDP 161 |
| SSH | TCP 22 |
| Telnet | TCP 23 |
| HTTP and HTTPS | TCP 80 and 443 |
| NETCONF | TCP 22, or 830 if you set it |
| Console servers | TCP 7001 |
Every port can be changed on the device’s connection. To check whether a device is reachable, the gateway tries SNMP, then HTTP, then SSH. It doesn’t use ping.