Ports & Endpoints
This page lists the ports you actually open on a firewall or point a device at. It covers the collector's outbound path to the Orchestrator, the LAN ports the collector listens on to receive telemetry, the operator WebUI, and the single public entry point for the Orchestrator SaaS.
For the reasoning behind each path, segmentation guidance, and connectivity checks, see Firewall & Network.
Collector outbound
The collector needs one outbound direction: HTTPS to the Orchestrator. There are no inbound connections from the internet to the appliance.
| Direction | Port | Protocol | Purpose |
|---|---|---|---|
| Outbound | 443 | TCP / HTTPS | Registration, heartbeat, and telemetry upload to the Orchestrator at ozone.techforcz.com |
| Outbound | 443 | TCP / HTTPS | Collector download and registration endpoints (install and enrolment) |
443 outbound is the only path the collector requires to reach TechForcz. Everything the collector sends to the Orchestrator rides this connection.
Collector LAN listeners
These are the receiver ports the appliance opens on your local network so devices can send telemetry to it. Point your switches, routers, and hosts at the collector's LAN address on the relevant port. None of these are exposed to the internet.
| Direction | Port | Protocol | Purpose |
|---|---|---|---|
| Inbound (LAN) | 514 | UDP | Syslog |
| Inbound (LAN) | 162 | UDP | SNMP traps |
| Inbound (LAN) | 2055 | UDP | NetFlow v5 |
| Inbound (LAN) | 9995 | UDP | NetFlow v9 |
| Inbound (LAN) | 4739 | UDP | IPFIX |
| Inbound (LAN) | 6343 | UDP | sFlow |
| Inbound (LAN) | 8125 | UDP | StatsD |
| Inbound (LAN) | 4317 | TCP | OTLP over gRPC |
| Inbound (LAN) | 4318 | TCP | OTLP over HTTP |
These listeners accept traffic from your network only. Keep them inside your LAN or management segment and do not forward them from the internet.
Collector operator WebUI
| Direction | Port | Protocol | Purpose |
|---|---|---|---|
| Inbound (LAN) | 3000 | TCP / HTTP | Operator WebUI on the appliance, for local administration |
The WebUI is intended for LAN access only. Reach it from a browser on the same network as the appliance.
Orchestrator (SaaS)
The Orchestrator presents a single public entry point. All customer and collector traffic terminates at the API gateway over HTTPS.
| Direction | Port | Protocol | Purpose |
|---|---|---|---|
| Inbound (to SaaS) | 443 | TCP / HTTPS | All customer and collector traffic to the API gateway at ozone.techforcz.com |
Individual microservices behind the gateway are not exposed publicly. You never connect to anything other than ozone.techforcz.com on 443.
Related
- Firewall & Network: segmentation, DNS and NTP, and how to verify connectivity.
- API Reference: what rides the Orchestrator's 443 entry point.