Allowlist requirements for IP addresses and URLs

To allow seamless connectivity to the Datto RMM web interface and between Agents, you must open TCP port 443 outbound through your firewall.

If your company has a more aggressive security posture for outbound traffic (for example, port blocking and IP address access lists), then you may need to add a number of IP addresses to the allowlist as well as open up port 443 to allow Datto RMM to make the required connections. The IP addresses you must add to the allowlist are specific to your platform, and you only need to add those associated with your platform.

NOTE  For information about the platform your site is hosted on, refer to Datto RMM platforms.

IMPORTANT  In order to reduce security false positives, improve monitoring and automation reliability, and make our Agent’s allowlisting more comprehensive, we now make use of a temporary directory underneath the Datto RMM Agent’s installation path rather than the %TEMP% folder.
This change affects all supported operating systems (Windows, macOS, and Linux). The new paths are as follows:
• Windows: %ProgramData%\CentraStage\Temp, %ProgramData%\CentraStage\AEMAgent\Temp
• macOS and Linux: usr/local/share/CentraStage/Temp, usr/local/share/CentraStage/AEMAgent/Temp

The following operations no longer create or modify files in the %TEMP% folder:

• Script files
• Downloading of Agent Modules packages
• CagService update
• Agent update
• Downloading of Windows Updater file
• Vine VNC setup script file (macOS)
• Screen Capture (macOS)
• Web Remote file transfer

NOTE  If the CagService, Agent, or Web Remote operations are not able to create or use their own Temp directory, all operations above will fallback to using the default %TEMP% folder.

For partners managing devices in environments with rigorous network security, note that port 13300 (UDP) is used for Agent discovery.

The initial connection between browser and Agent is initialized via WebRTC servers. Refer to WebRTC. Depending on the firewall configuration, the connection will resolve via STUN server (when P2P connection is possible) or TURN server (when Relay connection would be chosen). The WebRTC servers are located in several regions. Refer to DNS A records.

The minimum requirements for Web Remote are as follows: outbound port 3478 and ports between 49152 - 65535 should be open (both TCP and UDP) for the tunnel server DNS A record. Refer to DNS A records. In addition, make sure to add the following URLs to the allowlist:

For partners using Advanced Software Management, the following URL and IP addresses must not be blocked for the feature to function correctly: 

URL: 

• smpm.kaseya.com

IP addresses:

• 3.12.226.125
• 3.140.114.91
• 3.142.162.228

IMPORTANT  Advanced Software Management does not currently support proxy-configured Datto RMM agents.

Refer to Advanced Software Management.

Unless a peer-to-peer connection can be established between devices, Agent to Agent connectivity and remote takeover are managed by a tunnel server over an encrypted connection. Tunnel servers are connection relays located around the globe to provide maximum coverage and the best performance depending on your location. They are automatically available to all users.

When a remote takeover session is initiated:

1. The admin device performs a DNS query to find the nearest tunnel server. The tunnel server is picked based on the proximity to the admin device.

   NOTE  When connecting to a device via Web Remote, the tunnel server is picked based on proximity to the remote device instead of the admin device.

2. A connection is made to a load-balanced tunnel server cluster.

3. Finally, a connection is established to the remote device.

To make the most of the tunnel server grid, please ensure that the IP addresses relevant to your geographic location are added to the allowlist and outbound traffic on port 443 is open on your own and your endpoints' firewalls.

The following rules are configured for all local and remote ports:

Rule Name	Protocol	Description	Inbound	Outbound
AEMAgent	ANY	Datto RMM Agent Process
CentraStage_monitor	TCP/UDP	Datto RMM Monitoring Agent
CentraStage_service	TCP/UDP	Datto RMM Agent Service
RMM RTC Proxy	ANY	Datto RMM Web Remote RTC Proxy Service
RMM RTO Proxy	ANY	Datto RMM Web Remote RTO Proxy Service
RMM Web Remote	ANY	Datto RMM Web Remote Process
uVNC_Service	TCP/UDP	uVNC Service for VNC Connections

The Datto RMM Agent communicates with the platform using the IPv4 protocol.

NOTE  IPv6 connections are not supported at this time.

It is strongly recommended that any Stateful Packet Inspection be turned off for access to any centrastage.net address, and that all attempts possible are made to guarantee that TCP connections to the cc.centrastage.net addresses are not terminated in cases of inactivity (these connections may be inactive for up to 180 seconds at a time if no client activity is detected).

To help ease the burden of administration and reduce human error when managing allowlists across multiple firewalls, a series of DNS A records that will return every IP address applicable for a given platform is available. These records are as follows:

• concord-ips.centrastage.net
• vidal-ips.centrastage.net
• zinfandel-ips.centrastage.net
• merlot-ips.centrastage.net
• pinotage-ips.centrastage.net
• syrah-ips.centrastage.net

We also provide a secondary DNS A record at tunnel-ips.centrastage.net which can be used in the same way as the platform records to provide allowlisting services to the Datto RMM tunnel server infrastructure. Combining these two records allows administrators to provide complete coverage of the Datto RMM solution without needing to add IP addresses manually.

Querying the DNS A records

NOTE  There may be some cases where the individual IP addresses to which the above DNS A records direct need to be understood. In this instance, all major operating systems offer tools which can query the records and return a list of IP addresses. Bear in mind that these IP addresses will only be accurate as of the time of the list's production, with the addresses liable to change over time.

To query the DNS A records, use the following commands depending on your operating system:

• Windows: nslookup <platform>-ips.centrastage.net
• Linux: dig <platform>-ips.centrastage.net, host <platform>-ips.centrastage.net, or nslookup <platform>-ips.centrastage.net
• macOS: host <platform>-ips.centrastage.net

For more information, refer to this Kaseya Community post.

Using DNS A Records

These DNS A records can be added as hosts to any firewall configuration. The IP addresses to which the records point may change over time but the DNS will remain consistent, ensuring connection stability.

In a case where the IP addresses to which the records direct are required, the above section on querying DNS A records can be consulted. Bear in mind that due to the infrastructure on which Datto RMM is built these IPs are liable to change over time.

Some countries are not permitted access to the Datto RMM web interface. For more information, refer to Blocklist.