Network ports
Every port Billet uses, which direction it is opened in, and which part needs it.
- For
- Administrators
- Applies to
- Billet 1.0
- Updated
Inbound
| To | Port | From | For |
|---|---|---|---|
| Portal (its reverse proxy) | TCP 443 | Everyone: people, the Billet app, hosts, relays, identity providers (SCIM) | Sign-in, the console, desktops lists, enrollment and check-ins |
| Portal (its reverse proxy) | TCP 80 | Everyone | Redirect to HTTPS, and Let's Encrypt renewals |
| Relay | UDP 4444 | People's computers and hosts | Relayed sessions from the Billet app |
| Relay | TCP 443 (or the port you chose) | People's browsers | Browser sessions, over a secure WebSocket |
| Relay | TCP 80 | Let's Encrypt | Only while its certificate is issued or renewed |
| Host | UDP 4455 | People's computers | Direct sessions only. Not needed when everything goes through the relay. |
The portal itself listens on 127.0.0.1:5150, reached only by its reverse proxy on the same server.
Outbound
| From | To | Port | For |
|---|---|---|---|
| Portal | license.billetstream.com |
TCP 443 | License activation and hourly check-ins |
| Portal | Your identity provider | TCP 443 | Fetching its SAML metadata, where you gave a metadata address |
| Portal | Each relay | UDP 4444 | Setting up each relayed session |
| Portal | PostgreSQL | TCP 5432 | Its database, if on another server |
| Host | Portal | TCP 443 | Enrollment, check-ins and session requests |
| Host | Relay | UDP 4444 | Relayed sessions |
| Relay (stats agent) | Portal | TCP 443 | Enrollment and check-ins |
| Billet app | Portal | TCP 443 | Sign-in and the desktops list |
| Billet app | Relay, or a host | UDP 4444, or UDP 4455 | The session |
Every connection a host makes is outbound, so a host can sit behind NAT with no inbound rules.
Amazon DCV
DCV desktops never use the relay. They go through your DCV Connection Gateway, which needs its own rules:
| From | To | Port | For |
|---|---|---|---|
| People's DCV clients | Gateway | TCP 8443 and UDP 8443 | DCV sessions (UDP for QUIC, the default) |
| Gateway | Each DCV desktop | TCP 8443 and UDP 8443 | The session, on the desktop's private address |
| Gateway | Portal's DCV listener | TCP 443 | Which desktop a session belongs to |
| DCV desktop | Portal's DCV listener | TCP 443 | Whether a session's token is real |
| DCV desktop | Portal | TCP 443 | Enrollment and agent check-ins |
Unlike a Billet host, a DCV desktop takes an inbound connection, from the gateway only. See Networking: the DCV gateway and the Billet relay.