Ports, proxies and firewalls

A Tracix Collector opens every management and data connection itself, over HTTPS on port 443. It listens only on the ports its policy's integrations need, such as syslog or SNMP traps. Use this page to write firewall rules and to run collectors behind a proxy.

Outbound connections

Allow these from every host that runs a collector. All of them are TCP 443 with TLS.

In these host names, <workspace> is your workspace ID: the 8-character code at the end of your workspace's address, such as a7k3p2q9 in production-environment-a7k3p2q9.app.tracix.io.

Integrations add their own outbound connections: an SNMP integration polls devices on UDP 161, and a cloud integration calls its provider's APIs. Allow those from the collector to the targets you configure.

Ping is expected to fail against Tracix hosts, because their load balancers don't answer it. Test the path on port 443 instead:

curl -sv https://agents-<workspace>.app.tracix.io

curl -sv https://agents-<workspace>.app.tracix.io

Test-NetConnection agents-<workspace>.app.tracix.io -Port 443

Applications and browsers

Applications instrumented with OpenTelemetry can send to your workspace directly, and browsers always do. All of these are TCP 443 with TLS:

See OTLP endpoint and ingest keys.

Inbound ports

A collector listens only for what its policy asks for. Open these on the host's firewall, from the devices that send:

To see what a collector actually listens on, open it on Collectors: Listening on lists each port with its protocol and the integration that opened it.

Ports below 1024

UDP 162 and 514 are privileged ports, so not every collector can open them:

• Linux. The collector runs as an unprivileged user with the one capability that lets it bind low ports. Hosts installed before the installer granted it get it when you run the current installer again; until then, Tracix gives them no listener below 1024.
• Kubernetes. The chart's default profile runs as a non-root user on the host network and can't bind ports below 1024, so Tracix gives it no trap or syslog listener there. Set the integration to a port of 1024 or above, such as UDP 1162 for traps or 1514 for syslog, and point devices at that port on the node, or redirect the standard port to it on every node. Profiles that run as root, such as the ones for container logs or eBPF tracing, can bind the standard ports.
• Docker. The console's command publishes traps on host UDP 1162 by default and forwards them to the container's port. Set TRACIX_TRAP_HOST_PORT before you run it to use another host port.
• macOS and Windows. The service can bind low ports.

The collector reports a listener it can't open as a failed integration and keeps running the rest of its policy. See Troubleshoot the collector.

Host firewalls

Local ports

These answer on the collector's own host and are not meant to be reached from the network:

On Linux, macOS and Windows hosts both listen on 127.0.0.1 only. In containers they listen on every interface, so Kubernetes probes and Docker port mappings can reach them.

Use an HTTP proxy

The collector sends its management traffic, its WebSocket and its data through a standard HTTP proxy. Give the proxy at install:

curl -fsSL --proxy http://proxy.example.com:3128 https://charts.tracix.io/install.sh | sudo bash -s -- \
--endpoint https://agents-<workspace>.app.tracix.io \
--token-file /root/tracix-token \
--proxy http://proxy.example.com:3128 \
--no-proxy localhost,127.0.0.1,::1,.corp.example.com

curl -fsSL --proxy http://proxy.example.com:3128 https://charts.tracix.io/install.sh | sudo bash -s -- \
--endpoint https://agents-<workspace>.app.tracix.io \
--token-file /var/root/tracix-token \
--proxy http://proxy.example.com:3128

powershell -NoProfile -ExecutionPolicy Bypass -File $installer -Endpoint https://agents-<workspace>.app.tracix.io -TokenFile C:\tracix-token -Proxy http://proxy.example.com:3128

extraEnv:
- name: HTTPS_PROXY
  value: http://proxy.example.com:3128
- name: NO_PROXY
  value: localhost,127.0.0.1,10.0.0.0/8,.svc,.cluster.local

-e HTTPS_PROXY=http://proxy.example.com:3128 \
-e NO_PROXY=localhost,127.0.0.1

• Put proxy credentials in the URL, such as http://user:password@proxy.example.com:3128. The installer never prints them.
• --no-proxy (-NoProxy) lists the hosts that bypass the proxy. It defaults to localhost,127.0.0.1,::1.
• Pass --proxy again every time you run the installer, for example to upgrade, or the new environment file won't have it.
• A proxy that inspects TLS breaks the collector's connections. Exempt the Tracix hosts from inspection.
• When a proxy blocks WebSockets, the collector falls back to polling over HTTPS, so it keeps working with slower configuration changes.

Source IP allowlist

Each workspace can restrict which networks may reach its public endpoints. In the console, open your workspace, then the Access tab, and find Source IP allowlist. While the list is empty, every network can connect; authentication still applies. Once you add a range, add the public addresses your collectors, proxies and applications send from, or their connections are refused. Changes apply when the workspace finishes reconfiguring.

Next steps