# Ports, proxies and firewalls Every host and port a Tracix Collector connects to or listens on, how to send it through an HTTP proxy, and which firewall rules to open. A Tracix Collector opens every management and data connection itself, over HTTPS on port 443. It listens only on the ports its policy's integrations need, such as syslog or SNMP traps. Use this page to write firewall rules and to run collectors behind a proxy. In the commands on this page, replace `` with your workspace ID: the eight characters that end your workspace's address, before `.app.tracix.io`. ## Outbound connections Allow these from every host that runs a collector. All of them are TCP 443 with TLS. In these host names, `` is your workspace ID: the 8-character code at the end of your workspace's address, such as `a7k3p2q9` in `production-environment-a7k3p2q9.app.tracix.io`. | Host | Used for | | ------------------------------------- | ------------------------------------------------------------------------------- | | `agents-.app.tracix.io` | Enrollment, configuration, heartbeats and commands, over HTTPS and a WebSocket | | `ch-.app.tracix.io` | The telemetry the collector writes to your workspace's data store | | `charts.tracix.io` | The installers, release downloads and managed upgrades of host collectors | | `public.ecr.aws` | The collector image, for Docker and Kubernetes | | `otlp-http-.app.tracix.io` | Docker and Kubernetes collectors, which are given your OTLP endpoint at install | Integrations add their own outbound connections: an SNMP integration polls devices on UDP 161, and a cloud integration calls its provider's APIs. Allow those from the collector to the targets you configure. Ping is expected to fail against Tracix hosts, because their load balancers don't answer it. Test the path on port 443 instead: #### Linux ```bash curl -sv https://agents-.app.tracix.io ``` #### macOS ```bash curl -sv https://agents-.app.tracix.io ``` #### Windows ```powershell Test-NetConnection agents-.app.tracix.io -Port 443 ``` ### Applications and browsers Applications instrumented with OpenTelemetry can send to your workspace directly, and browsers always do. All of these are TCP 443 with TLS: | Host | Used for | | ------------------------------------- | -------------------------------- | | `otlp-.app.tracix.io` | OTLP over gRPC | | `otlp-http-.app.tracix.io` | OTLP over HTTP (`http/protobuf`) | | `rum-.app.tracix.io` | Browser RUM | See [OTLP endpoint and ingest keys](https://tracix.io/docs/collect/instrument/otlp). ## Inbound ports A collector listens only for what its policy asks for. Open these on the host's firewall, from the devices that send: | Integration | Default port | Notes | | ----------------------------------------------------- | -------------------------------- | ------------------------------------------------------------------------ | | [OTLP](https://tracix.io/integrations/otlp) | TCP 4317 (gRPC), TCP 4318 (HTTP) | For applications that send to the collector instead of to your workspace | | [SNMP traps](https://tracix.io/docs/collect/network-data/snmp) | UDP 162 | Set in the SNMP integration's trap settings | | [Syslog](https://tracix.io/docs/collect/network-data/syslog) | UDP 514 | TCP is an option; the port is set in the integration's listen address | | [NetFlow and IPFIX](https://tracix.io/docs/collect/network-data/flows) | UDP 2055 | Set in the integration's listen port | | [sFlow](https://tracix.io/docs/collect/network-data/flows) | UDP 6343 | Set in the integration's listen port | To see what a collector actually listens on, open it on **Collectors**: **Listening on** lists each port with its protocol and the integration that opened it. ### Ports below 1024 UDP 162 and 514 are privileged ports, so not every collector can open them: * **Linux.** The collector runs as an unprivileged user with the one capability that lets it bind low ports. Hosts installed before the installer granted it get it when you run the current installer again; until then, Tracix gives them no listener below 1024. * **Kubernetes.** The chart's default profile runs as a non-root user on the host network and can't bind ports below 1024, so Tracix gives it no trap or syslog listener there. Set the integration to a port of 1024 or above, such as UDP 1162 for traps or 1514 for syslog, and point devices at that port on the node, or redirect the standard port to it on every node. Profiles that run as root, such as the ones for container logs or eBPF tracing, can bind the standard ports. * **Docker.** The console's command publishes traps on host UDP 1162 by default and forwards them to the container's port. Set `TRACIX_TRAP_HOST_PORT` before you run it to use another host port. * **macOS and Windows.** The service can bind low ports. The collector reports a listener it can't open as a failed integration and keeps running the rest of its policy. See [Troubleshoot the collector](https://tracix.io/docs/collect/collector/troubleshooting#integration-failed). ### Host firewalls | Platform | What the installer does | | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | Windows | Adds one inbound rule, **Tracix Collector**, for the collector's program on any port, so devices reach whatever the policy listens on. | | Linux and macOS | Changes no firewall rules. Open the ports your policy listens on yourself. | | Kubernetes | The collector pods use the node's network, so devices send to the node's address. Allow the ports to your nodes, for example in their security groups. | | Docker | Publishes the trap port; publish other listener ports with `-p` when you run the container. | ## Local ports These answer on the collector's own host and are not meant to be reached from the network: | Port | Used for | | --------- | ---------------------------------------------------------------------------- | | TCP 13133 | The [health check](https://tracix.io/docs/collect/collector/configuration#local-health-check) | | TCP 18888 | The collector's own metrics, in Prometheus format | On Linux, macOS and Windows hosts both listen on `127.0.0.1` only. In containers they listen on every interface, so Kubernetes probes and Docker port mappings can reach them. ## Use an HTTP proxy The collector sends its management traffic, its WebSocket and its data through a standard HTTP proxy. Give the proxy at install: #### Linux ```bash curl -fsSL --proxy http://proxy.example.com:3128 https://charts.tracix.io/install.sh | sudo bash -s -- \ --endpoint https://agents-.app.tracix.io \ --token-file /root/tracix-token \ --proxy http://proxy.example.com:3128 \ --no-proxy localhost,127.0.0.1,::1,.corp.example.com ``` The installer uses the proxy for its own downloads and writes it to the service's environment as `HTTPS_PROXY`, `HTTP_PROXY` and `NO_PROXY`. #### macOS ```bash curl -fsSL --proxy http://proxy.example.com:3128 https://charts.tracix.io/install.sh | sudo bash -s -- \ --endpoint https://agents-.app.tracix.io \ --token-file /var/root/tracix-token \ --proxy http://proxy.example.com:3128 ``` #### Windows Add `-Proxy` and, if you need it, `-NoProxy` to the console's PowerShell command: ```powershell powershell -NoProfile -ExecutionPolicy Bypass -File $installer -Endpoint https://agents-.app.tracix.io -TokenFile C:\tracix-token -Proxy http://proxy.example.com:3128 ``` The installer stores the proxy in the service's environment. #### Kubernetes Set the standard proxy variables with the chart's `extraEnv` value, for example in a values file: ```yaml extraEnv: - name: HTTPS_PROXY value: http://proxy.example.com:3128 - name: NO_PROXY value: localhost,127.0.0.1,10.0.0.0/8,.svc,.cluster.local ``` #### Docker Add the standard proxy variables to the console's `docker run` command: ```bash -e HTTPS_PROXY=http://proxy.example.com:3128 \ -e NO_PROXY=localhost,127.0.0.1 ``` These cover the collector's own connections. To pull the image through the proxy, the Docker daemon needs its own proxy settings. * Put proxy credentials in the URL, such as `http://user:password@proxy.example.com:3128`. The installer never prints them. * `--no-proxy` (`-NoProxy`) lists the hosts that bypass the proxy. It defaults to `localhost,127.0.0.1,::1`. * Pass `--proxy` again every time you run the installer, for example to upgrade, or the new environment file won't have it. * A proxy that inspects TLS breaks the collector's connections. Exempt the Tracix hosts from inspection. * When a proxy blocks WebSockets, the collector falls back to polling over HTTPS, so it keeps working with slower configuration changes. ## Source IP allowlist Each workspace can restrict which networks may reach its public endpoints. In the console, open your workspace, then the **Access** tab, and find **Source IP allowlist**. While the list is empty, every network can connect; authentication still applies. Once you add a range, add the public addresses your collectors, proxies and applications send from, or their connections are refused. Changes apply when the workspace finishes reconfiguring. ## Next steps - [Install the collector](https://tracix.io/docs/collect/collector/install): With or without a proxy - [Configuration reference](https://tracix.io/docs/collect/collector/configuration): The environment file and local endpoints - [Endpoints and ports](https://tracix.io/docs/reference/endpoints-and-ports): Every Tracix endpoint in one table