Allowlist requirements for IP addresses and URLs

To allow seamless connectivity to the Datto RMM web interface and between Agents, you must open TCP port 443 outbound through your firewall.

If your company has a more aggressive security posture for outbound traffic (for example, port blocking and IP address access lists), then you may need to add a number of IP addresses to the allowlist as well as open up port 443 to allow Datto RMM to make the required connections. The IP addresses you must add to the allowlist are specific to your platform, and you only need to add those associated with your platform.

NOTE  For information about the platform your site is hosted on, refer to Datto RMM platforms.

IMPORTANT  In order to reduce security false positives, improve monitoring and automation reliability, and make our Agent’s allowlisting more comprehensive, we now make use of a temporary directory underneath the Datto RMM Agent’s installation path rather than the %TEMP% folder.
This change affects all supported operating systems (Windows, macOS, and Linux). The new paths are as follows:
• Windows: %ProgramData%\CentraStage\Temp, %ProgramData%\CentraStage\AEMAgent\Temp
• macOS and Linux: usr/local/share/CentraStage/Temp, usr/local/share/CentraStage/AEMAgent/Temp

The following operations no longer create or modify files in the %TEMP% folder:

• Script files
• Downloading of Agent Modules packages
• CagService update
• Agent update
• Downloading of Windows Updater file
• Vine VNC setup script file (macOS)
• Screen Capture (macOS)
• Web Remote file transfer

NOTE  If the CagService, Agent, or Web Remote operations are not able to create or use their own Temp directory, all operations above will fallback to using the default %TEMP% folder.

For partners managing devices in environments with rigorous network security, note that port 13300 (UDP) is used for Agent discovery.

The initial connection between browser and Agent is initialized via WebRTC servers. Refer to WebRTC. Depending on the firewall configuration, the connection will resolve via STUN server (when P2P connection is possible) or TURN server (when Relay connection would be chosen). The WebRTC servers are located in several regions. Refer to Method 1: Via FQDNs/DNS A records.

The minimum requirements for Web Remote are as follows: outbound port 3478 and ports between 49152 - 65535 should be open (both TCP and UDP) for the tunnel server DNS A record. Refer to Method 1: Via FQDNs/DNS A records.

The following URLs need to be added to the allowlist:

IMPORTANT  In addition, all DigiCert certificate status IPv4 addresses need to be allowed outbound access. The list of IP addresses and domains that need this access is located in the DigiCert Certificate Status IP Addresses article. There is a link to download a spreadsheet of this information at the bottom of the linked page.

For partners using Advanced Software Management, the following URL and IP addresses must not be blocked for the feature to function correctly: 

URL: 

• smpm.kaseya.com

IP addresses:

• 3.12.226.125
• 3.140.114.91
• 3.142.162.228

IMPORTANT  Advanced Software Management does not currently support proxy-configured Datto RMM agents.

Refer to Advanced Software Management.

Unless a peer-to-peer connection can be established between devices, Agent to Agent connectivity and remote takeover are managed by a tunnel server over an encrypted connection. Tunnel servers are connection relays located around the globe to provide maximum coverage and the best performance depending on your location. They are automatically available to all users.

When a remote takeover session is initiated:

1. The admin device performs a DNS query to find the nearest tunnel server. The tunnel server is picked based on the proximity to the admin device.

   NOTE  When connecting to a device via Web Remote, the tunnel server is picked based on proximity to the remote device instead of the admin device.

2. A connection is made to a load-balanced tunnel server cluster.

3. Finally, a connection is established to the remote device.

To make the most of the tunnel server grid, please ensure that the IP addresses relevant to your geographic location are added to the allowlist and outbound traffic on port 443 is open on your own and your endpoints' firewalls.

The following rules are configured for all local and remote ports:

Rule Name	Protocol	Description	Inbound	Outbound
AEMAgent	ANY	Datto RMM Agent Process
CentraStage_monitor	TCP/UDP	Datto RMM Monitoring Agent
CentraStage_service	TCP/UDP	Datto RMM Agent Service
RMM RTC Proxy	ANY	Datto RMM Web Remote RTC Proxy Service
RMM RTO Proxy	ANY	Datto RMM Web Remote RTO Proxy Service
RMM Web Remote	ANY	Datto RMM Web Remote Process
uVNC_Service	TCP/UDP	uVNC Service for VNC Connections

The Datto RMM Agent communicates with the platform using the IPv4 protocol.

NOTE  IPv6 connections are not supported at this time.

It is strongly recommended that any Stateful Packet Inspection be turned off for access to any centrastage.net address, and that all attempts possible are made to guarantee that TCP connections to the cc.centrastage.net addresses are not terminated in cases of inactivity (these connections may be inactive for up to 180 seconds at a time if no client activity is detected).

Some countries are not permitted access to the Datto RMM web interface. For more information, refer to Blocklist.