Ports and firewalls
What the agent needs to reach, and why no inbound rule is required anywhere.
Required outbound access
Allow these from every device running SXAccess. A rule that allows outbound UDP to any address and port covers direct tunnels and STUN.
| Destination | Port | Purpose |
|---|---|---|
mgmt.sxaccess.com | TCP 443 | Management - enrolment, the network map stream, access rule updates. Built into every client. |
app.sxaccess.com | TCP 443 | Sign-in from the browser, the apps and the CLI; the dashboard; the REST API. |
pkgs.sxaccess.com | TCP 443 | Installers and update checks. |
| Discovery | TCP 443 over TLS; endpoint handed out by management | Sealed negotiation messages while two agents set up a tunnel. |
| Relay | TCP 443 over TLS; endpoint handed out by management | Carries the tunnel until a direct path is found, and whenever none can be found. |
| STUN / TURN | Handed out by management | Learning the device's public address; TURN relaying, only when one of the two devices has no SXAccess relay. |
| Other devices, at any address | UDP, any port | Direct tunnels. The port on the far end is whatever that device's NAT maps, so it cannot be listed in advance. |
sxaccess info -dThe tunnel port
The CLI agent listens on UDP 51820 by default. If that port is already in use, it picks another free one. The apps use a random UDP port. That is only the local end: the other device can use any port its NAT picks, so do not limit outbound UDP to 51820.
You never have to open or forward this port. Both devices send to each other at the same time, and each side's NAT or firewall lets the other's packets in as replies; that is hole punching, explained in NAT and connectivity. An outbound rule that allows UDP to any address and port is all a direct tunnel needs. If a firewall between your own networks filters UDP, allow it between the devices that should talk directly.
Restrictive environments
Some corporate networks block UDP outbound entirely. Direct tunnels then cannot form and every connection stays on the relay; the relay runs over TLS on TCP 443, so the network keeps working at the cost of latency.
The apps trust only the certificate authorities bundled with them, so a proxy that inspects TLS on the way to mgmt.sxaccess.com or app.sxaccess.com breaks them. Exempt both hosts from TLS inspection, together with the Discovery and relay endpoints that sxaccess info -d lists.
sxaccess info -d tells you which devices are P2P and which are Relayed. In the apps, the Path on the Devices page says the same: it begins with Direct or Relayed. That is the fastest way to tell a blocked-UDP network from a NAT problem. A headline of Partly connected means the agent reaches only one of the two: the management service or Discovery.
To check a host, run the commands below. Each curl prints an HTTP status code: any code other than 000 means the host answered, and 000 means no answer arrived. The first tests the management service, the second sign-in, the dashboard and the REST API. sxaccess info -d then shows what the agent itself thinks.
curl -sS -o /dev/null -w '%{http_code}\n' https://mgmt.sxaccess.comcurl -sS -o /dev/null -w '%{http_code}\n' https://app.sxaccess.comsxaccess info -d