Firewall rules created by the agent

The Datto RMM Agent and its modules automatically create host firewall entries on managed devices so they can communicate with the Datto RMM platform. Administrators use this information to audit managed devices, configure Group Policy, and clean up after an uninstall.

Key context

Every entry that the agent creates is scoped to a specific program. None of the entries opens a listening port or allows traffic for any other application. The agent connects outbound to the Datto RMM platform. You don't need to configure the firewall manually for these components.

This topic has one section for each group of entries:

Windows firewall rules managed by the Datto RMM Agent

On Windows endpoints, the agent and its modules automatically create and maintain Windows Defender Firewall rules so they can communicate with the Datto RMM service. This section describes which rules the agent engine and its modules create, when the agent creates them, and when the agent removes them.

NOTE  The Datto RMM Agent does not create these rules on macOS or Linux.

Rule properties

The Datto RMM Agent creates rules for the agent engine (AEMAgent.exe) and for three modules: Web Remote, Advanced Software Management, and Agent Updater. The agent creates the rules with netsh advfirewall firewall, so they appear in Windows Defender Firewall with Advanced Security and in the output of netsh advfirewall firewall show rule name=all.

Every rule that the agent creates for the agent engine and modules has the same properties:

  • The action is Allow.
  • The rule is enabled.
  • Each name has two rules: one Inbound and one Outbound.
  • The scope is the specific program (executable) only, not a port or address range.

When the agent rules are created

Agent core component (AEMAgent)

At every agent startup, the agent removes any existing AEMAgent rule and creates a new one that points to AEMAgent.exe in the agent installation folder. This keeps the rule correct if the installation path changes.

Agent modules

The Datto RMM Agent downloads and updates modules independently of itself, and each version is installed in its own folder. The agent creates a rule for a specific version of the module executable in these cases:

  • A module version is newly installed.
  • A module version that is already on disk is detected, for example after an agent restart.

Before the agent adds the new rule, it removes any older rule with the same name. This guarantees exactly one pair of rules (inbound and outbound) for each installed module version.

NOTE  Rule names are stable, so you can reference them in monitoring or compliance checks. Module rule names include the version and change when a module updates.

When agent rules are removed

  • Agent starts: The agent replaces AEMAgent. It removes all Web Remote and Advanced Software Management rules and re-creates them for the versions currently installed.
  • A newer module version is running: The agent removes the rules for all older versions of that module, together with their old version folders.
  • A single module version folder is removed: The agent removes the rule for that version.
  • Legacy cleanup: The agent removes the retired Aria rule, if present, at agent startup.

NOTE  Because the rules are tied to a version number, old rules don't accumulate as modules update.

NOTE  Managing these rules requires the agent to run with administrative privileges, which is the default for the agent service.

Verifying the agent rules

  1. Open an elevated Command Prompt on the managed device.
  2. Type the following command and press Enter:

    netsh advfirewall firewall show rule name=all | findstr /i "AEMAgent RMM."

  3. Review the results. You should see one AEMAgent rule and one rule for each installed module version. Each name appears once for each direction (inbound and outbound).

Allow the agent engine and module programs through Group Policy

If your organization uses Group Policy to restrict local firewall rules, for example by setting Apply local firewall rules to No, Windows ignores locally created rules. In that case, create equivalent allow rules through policy.

  1. Open your Group Policy management tool.
  2. Create an allow rule for AEMAgent.exe in the agent installation folder.
  3. Create an allow rule for the executable of each installed module: Web Remote, Advanced Software Management, and Agent Updater.

NOTE  The AEMAgent rule name is stable, so you can reference it in monitoring or compliance checks. Module rule names include the version and change when a module updates.

Agent engine and module rules summary

Rule name Applies to Created Removed
AEMAgent Applies to AEMAgent.exe in the agent installation folder. Every time the agent starts. Replaced on each agent start.
RMM.WebRemote <version> Applies to the Web Remote module executable. When the module version is installed or detected. When a newer version replaces it; on agent start.
RMM.AdvancedSoftwareManagement <version> Applies to the Advanced Software Management module executable. When the module version is installed or detected. When a newer version replaces it; on agent start.
RMM.AgentUpdater <version> Applies to the Agent Updater module executable. When the module version is installed or detected. When a newer version replaces it.

NOTE  <version> is the module build version, for example RMM.WebRemote 12.1.0.2993.

Host firewall entries by operating system

This section lists every host firewall entry that the Datto RMM Agent and its modules create on a managed device, grouped by operating system (OS). It includes the entries that the installer creates and the manual steps to remove entries after you uninstall the agent.

How host firewall entries work

All entries are scoped to a specific program. None of them opens a listening port or allows traffic for any other application. The entries that the agent creates depend on the OS.

Windows installer entries

If the Windows Firewall service is running, the installer adds two program exceptions: CentraStage_service for the agent service (CagService.exe) and CentraStage_monitor for the agent tray and monitor process (Gui.exe). The installer creates these entries when you install or reinstall the agent, and the uninstaller removes them.

Windows agent engine and module entries

The Datto RMM Agent adds the agent engine and the modules it manages as Windows Defender Firewall rules by using netsh advfirewall. Each program gets an inbound rule and an outbound rule with the same name. The rules are program-based and aren't limited to a port or address.

Module rules include the module version in their name, for example RMM.WebRemote 10.6.0.1. When you install a new version of a module, the agent creates a rule for the new version and deletes the rules for replaced versions.

The following table shows which modules create a firewall rule:

Module Creates a firewall rule
Web Remote Yes
Advanced Software Management Yes
Agent Updater Yes
Advanced Threat Detection (EDR) No

Windows UltraVNC restriction

The RMM WINVNC entry is the only entry that restricts traffic instead of allowing it. It blocks outbound connections from winvnc.exe, the bundled UltraVNC server. The VNC server can accept connections made to it, but it can't start a connection to another host. The agent also limits file access to winvnc.exe to the SYSTEM account.

macOS entries

The installer adds /Applications/RMM Agent.app to the macOS Application Firewall and sets it to allow incoming connections. If the Application Firewall is enabled, the installer turns it off for a moment while it makes the change and turns it back on afterward. The uninstaller does the same when it removes the entry.

Linux entries

The Linux agent does not create or change any firewall configuration.

When entries are removed

  • Agent uninstall (Windows): The uninstaller removes CentraStage_service and CentraStage_monitor.
  • Agent uninstall (macOS): The uninstaller removes RMM Agent.app.
  • New module version installed: The agent removes the rule for the replaced version of that module.
  • Agent engine starts: The agent clears the existing Web Remote and Advanced Software Management rules and re-creates them for the installed version.
  • UltraVNC disabled by policy and uninstalled by the agent: The agent removes RMM WINVNC.

NOTE  The AEMAgent rules, the module rules, and the RMM WINVNC rule are program-based rules. Uninstalling the agent doesn't remove them, you must manually remove them. Refer to Remove the agent engine and module rules manually.

View the firewall entries on a Windows device

  1. Open an elevated Command Prompt or PowerShell on the managed device.
  2. Type the following command and press Enter:

    netsh advfirewall firewall show rule name=all | findstr /i "AEMAgent RMM CentraStage"

  3. Review the results.

You can also view the entries in the Windows Defender Firewall with Advanced Security console:

  1. Open Windows Defender Firewall with Advanced Security.
  2. Click Inbound Rules or Outbound Rules.
  3. Filter the list by AEMAgent, RMM, or CentraStage.

View the firewall entry on a macOS device

  1. Open Terminal on the managed device.
  2. Type the following command and press Return:

    /usr/libexec/ApplicationFirewall/socketfilterfw --listapps

  3. Locate RMM Agent.app in the list.

Remove the agent engine and module rules manually

Remove the rules manually after you uninstall the agent.

  1. Open an elevated Command Prompt or PowerShell on the Windows device.
  2. Type each of the following commands that applies and press Enter. Each command uses the exact name of a rule as shown in Windows Defender Firewall.
    • netsh advfirewall firewall delete rule name="AEMAgent"
    • netsh advfirewall firewall delete rule name="RMM WINVNC"
    • netsh advfirewall firewall delete rule name="RMM.WebRemote <version>"
    • netsh advfirewall firewall delete rule name="RMM.AdvancedSoftwareManagement <version>"
    • netsh advfirewall firewall delete rule name="RMM.AgentUpdater <version>"

    NOTE  For module rules, replace <version> with the exact version shown in the rule name, for example 10.6.0.1.

Host firewall entries summary

Entry name OS Purpose Type Created Removed
CentraStage_service Windows Agent service (CagService.exe) Program exception (allow) When the agent is installed or reinstalled When the agent is uninstalled.
CentraStage_monitor Windows Agent tray/monitor process (Gui.exe) Program exception (allow) When the agent is installed or reinstalled. When the agent is uninstalled.
AEMAgent Windows Agent engine (AEMAgent.exe) Inbound and outbound allow Each time the agent engine starts. See When agent rules are removed.
RMM.WebRemote <version> Windows Web Remote module Inbound and outbound allow When a version of the module is installed or loaded. When the version is replaced by a newer one. See When agent rules are removed.
RMM.AdvancedSoftwareManagement <version> Windows Advanced Software Management module Inbound and outbound allow When a version of the module is installed or loaded. When the version is replaced by a newer one. See When agent rules are removed.
RMM.AgentUpdater <version> Windows Agent updater module Inbound and outbound allow When a version of the module is installed. When the version is replaced by a newer one. See When agent rules are removed.
RMM WINVNC Windows Restricts the bundled UltraVNC server (winvnc.exe) Outbound block When UltraVNC is installed or updated by the agent. When UltraVNC is uninstalled by the agent. See When agent rules are removed.
RMM Agent.app macOS Agent application Application Firewall exception (allow) When the agent package is installed. When the agent is uninstalled.

Web Remote proxy rules on Windows

Web Remote creates two Windows Firewall rules on managed Windows devices so that remote sessions can connect. This section describes the rules, when the agent creates them, and how to view and remove them. Web Remote doesn't change firewall settings on macOS.

Web Remote proxy rules summary

Rule name Program it applies to Direction Action
RMM RTC Proxy RMM.RTC.Proxy.exe Inbound and Outbound Allow
RMM RTO Proxy RMM.RTO.Proxy.exe Inbound and Outbound Allow

NOTE  Both programs are installed in a subfolder of the Web Remote agent folder, in RMM.RTC.Proxy and RMM.RTO.Proxy respectively.

How Web Remote proxy rules work

Web Remote creates two rules. Each rule has an inbound entry and an outbound entry. Both rules allow traffic for one specific Web Remote program and don't open ports in general. The agent creates the rules automatically, so no action is needed from you.

Both programs are installed in a subfolder of the Web Remote agent folder, in RMM.RTC.Proxy and RMM.RTO.Proxy respectively.

  • RMM RTC Proxy handles the real-time (Web Real-Time Communication, or WebRTC) connection for remote sessions.
  • RMM RTO Proxy handles remote-control sessions that use the proxy-based connection path.

Rule properties

  • The rules are tied to the program path.
  • The rules don't restrict ports, remote addresses, or network profiles (Domain, Private, and Public).
  • The rules are enabled when the agent creates them.

When the agent creates the rules

The agent creates the rules when it first extracts the corresponding program on the device.

  • RMM RTC Proxy: The agent creates this rule each time the Web Remote service starts. The agent also creates it if a remote session needs the program and its folder is missing.
  • RMM RTO Proxy: The agent creates this rule when the first session that needs it starts. On Windows 7 and earlier, the agent creates it when the service starts.

NOTE  Each time the agent creates a rule, it first deletes any existing rule with the same name and then adds the rule again. This keeps the rule pointing at the current program location and stops duplicates from building up. You see one rule of each name, not several.

When the agent removes the rules

  • The agent deletes a rule only to re-create it.
  • The agent doesn't remove the rules when a session ends or when the service stops.
  • The rules stay in place while the agent is installed.

NOTE  To remove these rules, refer to Remove the Web Remote proxy rules manually.

View the Web Remote proxy rules

  1. Open an elevated Command Prompt or PowerShell on the managed device.
  2. Type the following commands and press Enter after each one:
    • netsh advfirewall firewall show rule name="RMM RTC Proxy"
    • netsh advfirewall firewall show rule name="RMM RTO Proxy"
  3. Review the results.

You can also view the rules in the Windows Defender Firewall with Advanced Security console:

  1. Open Windows Defender Firewall with Advanced Security.
  2. Click Inbound Rules or Outbound Rules.
  3. Locate RMM RTC Proxy and RMM RTO Proxy.

Remove the Web Remote proxy rules manually

Remove the rules manually if you decommission the agent, for example.

  1. Open an elevated Command Prompt or PowerShell on the Windows device.
  2. Type the following commands and press Enter after each one. Each command removes both the inbound and outbound entries.
    • netsh advfirewall firewall delete rule name="RMM RTC Proxy"
    • netsh advfirewall firewall delete rule name="RMM RTO Proxy"

NOTE  While the agent is still installed, the agent re-creates these rules the next time the service starts or a session needs them.

Allow the Web Remote proxy programs centrally

Creating the rules requires administrative rights. The Web Remote service runs as SYSTEM and meets this requirement. If the agent can't create a rule, for example because Group Policy blocks local firewall changes, the affected remote session type may not connect. If your environment blocks locally created firewall rules, allow the two programs centrally.

  1. Open your Group Policy management tool.
  2. Create allow rules for the following paths, where <agent folder> is the Web Remote agent folder:
    • <agent folder>\RMM.RTC.Proxy\RMM.RTC.Proxy.exe
    • <agent folder>\RMM.RTO.Proxy\RMM.RTO.Proxy.exe

Next steps

  • Review your Group Policy settings if your organization restricts locally created firewall rules.
  • Add the rule names in this topic to your monitoring or compliance checks.
  • Remove the leftover rules manually after you uninstall the agent from a Windows device.