Skip to main content

Firewall Information for the Agent

The Agent makes outbound-only connections to Files.com over encrypted connections. It operates inside typical enterprise firewall and NAT environments without inbound rules, port forwarding, or exposing internal systems to the public internet.

The Agent uses port 8801 for data transmission and separate connections for DNS lookups. It does not require any inbound network ports. The Direct Transfers feature is the one exception, adding an optional inbound listener for increased data transmission throughput with the Files.com CLI App and Desktop App.

Data Transmission

The Agent uses a single outbound network port, port 8801, for data transmission. This port cannot be customized.

The Agent uses both the UDP and TCP protocols. It first attempts to connect over the faster UDP protocol and falls back to TCP if UDP is unavailable.

The Agent connects to Files.com using the general pool of Files.com IP addresses. Make sure that outbound connections to these IP addresses using port 8801 are allowed through your firewall.

If your Files.com site uses a custom domain, the Agent connects using your dedicated IP addresses instead.

DNS Lookup

By default, the Agent tries DNS over HTTPS at https://cloudflare-dns.com on TCP port 443. If that fails, it falls back to the host's system resolver.

Allow access to the DNS service selected in the Agent configuration. System DNS normally uses port 53, not port 443. The dns_server setting can specify a different resolver and port. Setting dns to system skips DNS over HTTPS; setting it to doh uses DNS over HTTPS without the system fallback.

Direct Transfers

When Direct Transfers are enabled, allow inbound TCP and UDP connections to the Agent host on the listener ports, which default to 4001 through 4010, and forward each public port to the same port number on the Agent host. The port range and the rest of the listener configuration are set in the Agent configuration file.

When multiple nodes serve the Remote Server for Agent High Availability, every node's host needs inbound rules and port forwarding, and Direct Transfers covers how the port numbers relate across nodes. Clients connect to whichever node is handling their transfer, and a node whose ports stay closed serves its transfers over the standard connection route instead.