VeritGuard: Firewall and Network Allowlist Requirements
Explore essential firewall and network allowlist requirements for enhancing security and protecting your digital infrastructure.
Table of Contents
Firewall and Network Allowlist Requirements
Effective September 2026 | Last Updated on 25th September | Published by Parnav Dagar
Short answer: On most networks the only change required is allowing outbound TCP 443, plus the additional ports in Section 2 for remote support sessions and the VPN. If your firewall restricts outbound traffic by destination, or inspects encrypted traffic, you will need the entries in Sections 3 and 5 as well.
No inbound rules are needed. Nothing in this document requires you to open a port from the internet into your network, and no port forwarding or NAT rule is required.
1. Purpose and who this is for
This article lists the network access required for the tools running on your managed devices to reach their cloud services. Give it to whoever manages your firewall, whether that is an internal person, your internet provider, or a network vendor.
If your network uses a standard business router or firewall with default outbound rules, you almost certainly need to do nothing. These requirements apply where outbound traffic is restricted, where a web filtering or proxy appliance is in place, or where encrypted traffic is inspected.
1.1 Which sections apply to you
Most of this document applies to every plan. Use this table to skip the sections that do not apply to yours. If you are unsure which services are active on your account, ask us and we will confirm.
| Section | Applies to |
|---|---|
| 2. Ports | All plans |
| 3.1 Device monitoring and remote support | All plans |
| 3.2 Endpoint security | All plans |
| 3.3 Security operations monitoring | Elite only |
| 3.4 Endpoint backup | All plans |
| 3.5 Password management | Pro and Elite, and Essentials where taken as an add-on |
| 3.6 Certificate validation | All plans |
| 4. Secure remote access | All plans |
| 5. Encrypted traffic inspection | All plans, where your firewall inspects encrypted traffic |
| 6. Security software exclusions | All plans, where you retain a security product of your own |
| 7.1 Email security filtering | Pro and Elite, and Essentials where taken as an add-on |
| 7.2 Security awareness training and phishing simulations | Pro and Elite |
| 7.3 Our own correspondence | All plans |
| 9. Other technical requirements | All plans |
Permitting a rule for a service you do not currently have is harmless. Missing one for a service you do have means that service stops working, so if in doubt, apply the rule.
2. Ports
All entries are outbound from your network. Stateful firewalls permit the return traffic automatically, so no matching inbound rule is required.
| Purpose | Port | Direction | Applies to |
|---|---|---|---|
| Agent and console communication | TCP 443 | Outbound | All managed devices. This is the core requirement. |
| Remote support sessions | TCP and UDP 3478 | Outbound | All managed devices. Without this, devices report in normally but cannot be remotely supported. |
| Remote support session media | TCP and UDP 49152 to 65535 | Outbound | All managed devices. This is the standard ephemeral port range. |
| Endpoint security live channel | TCP 3030 and 3031 | Outbound | All managed devices. |
| Secure remote access (VPN) | UDP 1194, TCP 8443, UDP 51820 | Outbound | All managed devices where the VPN is deployed. The three ports cover the different connection protocols the client can negotiate. See Section 4. |
| Local device discovery | UDP 13300 | Inbound on your local network only | Optional. Only required where network discovery is enabled, and only between devices on your own LAN. Not from the internet. |
The most common problem: devices that appear online and healthy but cannot be remotely supported. This is almost always ports 3478 or the ephemeral range being blocked. If your technician reports that they cannot connect to a machine that is clearly online, this is the first thing to check.
3. Domains to allow
Allowlist by hostname wherever possible. These services run on cloud infrastructure and their IP addresses change without notice, so IP based rules will break over time. If your firewall only accepts IP addresses, contact us and we will supply a current list for your deployment and tell you when it changes.
3.1 Device monitoring and remote support
Two wildcard entries cover the majority of this traffic:
- *.centrastage.net
- *.rmm.datto.com
These additional endpoints are required regardless:
- update.centrastage.net
- storage.centrastage.net
- storage.rmm.datto.com
- auth.datto.com
- saml.datto.com
- tunnel.rmm.datto.com
- webrtc.rmm.datto.com
- dotnet.microsoft.com
- smpm.kaseya.com
3.2 Endpoint security
- *.infocyte.com
- dl.infocyte.com
- *.es.datto.net
- infocyte-downloads.s3.us-east-1.amazonaws.com
Amazon S3 and API endpoints in the us-east-2 and us-west-2 regions are also used for content delivery.
On Windows devices, also allow:
- query-api.eu1.apc.avira.com
- fpc-rest.tl.avira.com
- v2.web-rep.auc.avira.com
- download.avira.com
- api.mixpanel.com
On Mac devices, also allow:
- prod-auth.eu1.apc.avira.com
- prod-query.eu1.apc.avira.com
- prod-upload.eu1.apc.avira.com
- prod.tl.avira.com
3.3 Security operations monitoring
Applies to Elite only.
- app.rocketcyber.com
- ws.app.rocketcyber.com
- tls-us.rocketcyber.com
- dhs.us.rocketcyber.com
- agent.us.rocketcyber.com
- content.rocketcyber.com
- s3.amazonaws.com
3.4 Endpoint backup
Two entries, both outbound on TCP 443:
- *.datto.io
- cf-dl.datto.com
Backup traffic is substantial during the initial full backup of each device. If your firewall applies bandwidth shaping or per connection limits to outbound traffic, tell us before onboarding so we can schedule the initial backups appropriately. See also Section 6 for the folder exclusions the backup agent requires.
3.5 Password management
Applies where 1Password is included in your plan or taken as an add-on. Outbound TCP 443 to:
- *.1password.com
- *.1passwordservices.com
- *.1passwordusercontent.com
These additional endpoints support application updates, infrastructure identification and item icons:
- app-updates.agilebits.com
- app-updates.us.svc.1infra.net
- *.1infra.net
- cache.agilebits.com
Accounts hosted in the European or Canadian regions use different domains. If your account is not on the United States region, contact us and we will confirm the correct list.
3.6 Certificate validation
All agents check certificate status before connecting. Blocking this causes intermittent and hard to diagnose failures.
- *.digicert.com
4. Secure remote access
The business VPN is included on every plan. It needs the ports listed in Section 2 and the domains below. Note that the VPN is the one component here that requires ports other than 443.
- *.nordlayer.com
- *.nordlayers.com
If your firewall does not support wildcards, these specific hosts are required:
- api.nordlayer.com
- auth.nordlayer.com
- cp.nordlayer.com
Both domains are needed and they are not the same. One is nordlayer.com and the other is nordlayers.com, with an s. Missing the second is an easy transcription error and produces a VPN that authenticates but will not pass traffic reliably.
One setting to be aware of on the VPN client: the kill switch should remain switched off unless we have specifically asked you to enable it. It cuts internet access entirely if the VPN connection drops, which can lock a user out of their own machine and prevent us from reaching it to help.
5. Encrypted traffic inspection
If your firewall performs SSL inspection, deep packet inspection, or stateful packet inspection on encrypted traffic, the following exclusions are required. Inspecting this traffic does not make it more secure and will break the services.
| Setting | Required action |
|---|---|
| SSL or TLS decryption | Bypass decryption for all domains listed in Section 3. Certificate pinning is used, so inspected connections are rejected. |
| Stateful packet inspection | Disable for the monitoring platform domains in Section 3.1. |
| Idle connection timeout | The management control channel can sit idle for up to 180 seconds. Do not terminate these connections before then, or agents will repeatedly disconnect and reconnect. |
| Deep packet inspection on backup traffic | Disable. It has been observed to break support connectivity and degrade backup performance significantly. |
6. Security software exclusions
If you run any antivirus or endpoint security product of your own alongside ours, the following folders must be excluded from scanning. Without these exclusions the backup agent is liable to be quarantined or blocked, and backups will fail silently.
6.1 Windows
- C:\Windows\System32\config\systemprofile\AppData\Local\Datto Backup Agent\*
- %ProgramData%\Datto Backup Agent
- %ProgramFiles%\Datto Backup Agent
6.2 macOS
- /Applications/Datto Backup Agent.app
- /Library/Application Support/Datto Backup Agent/
Running two endpoint security products on the same device causes failed installations, unreliable protection and hard to diagnose performance problems. If you are retaining an existing product, tell us before onboarding so we can plan the transition rather than leaving both in place.
7. Email allowlisting
These are not firewall entries. They are configured in your Microsoft 365 or Google Workspace administration console, and we will normally do this for you where we hold administrative access.
7.1 Email security filtering
Applies to Pro and Elite, and to Essentials where email security is taken as an add-on. Permit these sending addresses so that filtered and quarantined message notifications reach your users:
- 100.24.129.5
- 3.132.222.232
- 100.21.157.149
- phishtest.inkyphishfence.com
7.2 Security awareness training and phishing simulations
Applies to Pro and Elite. Simulated phishing emails are designed to look like real ones, so your own filtering will block them unless these are permitted. If simulations are blocked, staff never receive the training and your completion reporting will be incomplete.
- 34.237.252.20
- service-noreply.info/*
- bpidtr.com/*
- *.bpidtr.com/*
- *.cloudsurveillance.net/*
Additional sending domains are specific to your account. We will supply the list for your tenant during onboarding and whenever it changes.
7.3 Our own correspondence
All communication from us is sent from a single domain. Permit it in your mail filtering:
- verito.com
This covers ticket correspondence, automated system alerts, onboarding communication and scheduled reports. Our messages being routed to a junk folder is a common and entirely avoidable cause of missed notifications, and it is usually only discovered when something important has already been missed.
8. Services that need no network changes
Several services operate entirely between cloud platforms and never touch your network. These require nothing from you:
- Cloud application backup for Microsoft 365 or Google Workspace
- Cloud application monitoring and sign-in alerting
- Dark web credential monitoring
- Compliance documentation and reporting
9. Other technical requirements
| Requirement | Detail |
|---|---|
| IPv4 | Agents communicate over IPv4 only. IPv6 is not supported. If your network is IPv6 only, contact us before deployment. |
| TLS 1.2 | Specific TLS 1.2 cipher suites must be enabled. This is the default on supported Windows versions and is only a consideration on hardened or older systems. |
| International travel | Access to the endpoint security platform is geographically blocked from a small number of countries, currently Russia, China, Cuba, Iran, North Korea and Syria. Tell us in advance if a staff member will be working from any of these so we can plan around it. |
10. What we need from you
- Tell us if outbound traffic is restricted. If your firewall blocks outbound traffic by default, or uses a web filter or proxy, let us know before we deploy so rules are in place first rather than being diagnosed afterwards.
- Tell us if encrypted traffic is inspected. This is the single most common cause of agents that install successfully and then fail intermittently.
- Tell us if you are keeping any existing security software. See Section 6.
- Tell us who manages your firewall. If it is a third party, we are happy to speak with them directly. Give us permission and a contact and we will handle it.
- Tell us before your network changes. A new firewall, a new internet provider or a new office all reset these rules.
11. Keeping this current
Cloud service endpoints change. We review these requirements periodically and will notify you if something you need to act on has changed. If you have built rules from an earlier version of this article, check it against this one before troubleshooting a connectivity problem.
12. Getting help
- General support: raise a ticket through your client portal or email itsupport@verito.com.
- 24/7 support desk: (844) 629-9899.
- Firewall or deployment questions: contact support and we will work directly with whoever manages your network.
Verito Technologies. Requirements listed here reflect the services active on your plan. If a section refers to a service you do not have, it does not apply to you. Contact support if you need this confirmed in writing for a security questionnaire or audit.
Table of Contents