Firewall Exceptions for Network Sensors and Endpoint Agents

Introduction

This article outlines the firewall exceptions you need to make for Field Effect's sensors and endpoint agents to communicate with Field Effect's services. To verify that your network sensor is functioning correctly, see our chapter Validating Your Deployment.

See How Field Effect MDR Works to learn more.

Requirements: Physical Sensors

All sensors (primary and remote) require outbound access to TCP port 443.

If your organization does not support this requirement, we have instructions that allow you to limit where the sensor can reach out to. Please reach out to support@fieldeffect.com for more on this.

Geo-Location access

If your firewall uses location-based blocking, make Canada an exception, as we're a Canadian company.

VPN Blockage

If your firewall blocks Tailscale or OpenVPN, allow them, because the server uses them to communicate with Field Effect systems.

Requirements: Self-Hosted Virtual Sensor

During a sensor's initial configuration, you must allow the following outbound connections:

• TCP/443— HTTPS to the following systems:
  • login.tailscale.com
  • controlplane.tailscale.com
  • derp1-all.tailscale.com
  • 192.200.0.0/24
• We recommend allowing outbound UDP traffic for efficiency, but it isn't required.

Requirements: Endpoint Agents

When a new endpoint agent is installed, it connects to the following systems to self‑configure: 

epid.fieldeffect.net, TCP/443
installlogs.fieldeffect.net, TCP/443