Collector Firewall & Network
The collector needs exactly one path to the internet: outbound TCP 443 to ozone.techforcz.com. Everything else is LAN-side, meaning devices reaching the appliance to be polled, plus DNS and NTP. No inbound flow from the internet or the Orchestrator is ever required.
1. Outbound (collector → internet)
Open only these. The first row is the single flow that matters for the Orchestrator.
| Port / Proto | Destination | Purpose | Required |
|---|---|---|---|
| 443 / TCP | ozone.techforcz.com | registration, heartbeat (30s), ingest | Yes, the only internet flow |
| 53 / UDP+TCP | customer DNS resolver | resolve ozone.techforcz.com | Yes |
| 123 / UDP | NTP source | clock sync (TLS fails on skew > 5 min) | Yes |
# Pre-flight from the appliance; these cover >80% of "cannot register" cases
nslookup ozone.techforcz.com # 1. DNS resolves
nc -vz ozone.techforcz.com 443 # 2. egress 443 open
curl -sS -o /dev/null -w '%{http_code}\n' \
https://ozone.techforcz.com/health # 3. TLS round-trip reaches the Orchestrator
timedatectl | grep -E 'synchronized|NTP' # 4. clock sane
Firewall allowlisting by name, not IP. The Orchestrator runs behind managed infrastructure whose IPs change. Allowlist the hostname
ozone.techforcz.comon the egress firewall (or its published egress range), not a single A record you resolved once.
2. Inbound from devices (LAN-side only)
These are the listener ports the monitored devices use to reach the appliance. They are LAN-internal, so never expose them to the internet. Open them only between the device subnets and the appliance.
Passive receivers (device-initiated to the appliance). These listeners are bound out of the box:
| Port / Proto | Protocol | Notes |
|---|---|---|
| 162 / UDP | SNMP trap | privileged port; needs root or a lowered ip_unprivileged_port_start |
| 2055 / UDP | NetFlow v5 | flow export |
| 9995 / UDP | NetFlow v9 | flow export |
| 4739 / UDP | IPFIX | flow export |
| 6343 / UDP | sFlow | flow export |
| 514 / UDP | Syslog | passive listener |
| 8125 / UDP | StatsD | metrics ingest |
| 4317 / TCP | OTLP gRPC | OpenTelemetry ingest |
| 4318 / TCP | OTLP HTTP | OpenTelemetry ingest |
Active poll targets (appliance initiates outward to devices). Open these from the appliance to the device subnets:
| Port / Proto | Protocol | Notes |
|---|---|---|
| 161 / UDP | SNMP poll | appliance initiates; device replies |
| 22 / TCP | SSH / CLI | server and network CLI polling |
| 443 / TCP | Redfish / vendor REST | iDRAC / iLO / CIMC, wireless controllers, storage and cloud APIs |
| 623 / UDP | IPMI | out-of-band server telemetry |
Passive receivers are ON by default, while active pollers ship disabled (empty target tables) until you onboard a device, so a fresh appliance makes no failed-poll noise. The full method-to-port mapping is in Collection Methods & Protocols.
Auto-discovery needs NET_RAW/NET_ADMIN to scan subnets, and synthetic probing needs NET_RAW for ICMP. These capabilities are granted to the containers in the shipped Compose, so no host firewall change is needed beyond reaching the target subnets.
3. Network placement & segmentation
Place the appliance where it can reach both the device subnets and the egress path:
- Management VLAN is the usual home, since it already has line of sight to network gear, server OOB (iDRAC/iLO), and hypervisor management.
- For segmented environments, allow the appliance's IP to reach each monitored subnet on the ports in §2, and allow it outbound 443 to the Orchestrator.
- The appliance's operator interface (the WebUI on
3000) is for operators on the LAN. If admins reach the WebUI from a different subnet, that path must be open browser-to-appliance, or panels render empty even though the appliance is healthy (a reachability issue, not a UI bug; see Troubleshooting).
4. Verify connectivity end to end
# 1. Name resolution and egress
getent hosts ozone.techforcz.com
nc -vz ozone.techforcz.com 443
# 2. The appliance can actually poll a device (example: SNMP)
docker exec aiops-universal-collector \
snmpget -v2c -c "<snmp-community>" 10.0.0.1 1.3.6.1.2.1.1.1.0 # sysDescr
# 3. The passive receivers are bound
sudo ss -ulnp | grep -E ':(162|514|2055|9995|4739|6343|8125)\b'
sudo ss -tlnp | grep -E ':(4317|4318)\b'
# 4. Clock (TLS depends on it)
chronyc tracking 2>/dev/null || timedatectl
If outbound 443 is open but the handshake still fails, the cause is usually a proxy or TLS interception, so continue to Outbound Proxy. If the path is clean and registration still fails, see Enrolment and Troubleshooting, TLS.
5. Common firewall failure signatures
| Symptom | Likely cause | Fix |
|---|---|---|
nslookup fails | DNS not permitted / wrong resolver | allow 53 to the customer resolver |
nc :443 times out | egress 443 closed or no route | open outbound 443 to ozone.techforcz.com |
| TLS error after 443 connects | proxy interception / clock skew | Proxy guide; fix NTP |
| Devices show no metrics | LAN path to device subnet blocked | open §2 ports between appliance and subnet |
| WebUI loads but panels empty from a remote PC | admin subnet can't reach appliance ports | open browser-to-appliance, or use the WebUI on-LAN |