Allowlist requirements for IP addresses and URLs

To allow seamless connectivity to the Datto RMM Web Portal and between Agents, you must open TCP port 443 outbound through your firewall.

If your company has a more aggressive security posture for outbound traffic (for example, port blocking and IP address access lists), then you may need to add a number of IP addresses to the allowlist as well as open up port 443 to allow Datto RMM to make the required connections. The IP addresses you must add to the allowlist are specific to your platform, and you only need to add those associated with your platform.

NOTE  For information about the platform your site is hosted on, refer to Datto RMM platforms.

IMPORTANT  In order to reduce security false positives, improve monitoring and automation reliability, and make our Agent’s allowlisting more comprehensive, we now make use of a temporary directory underneath the Datto RMM Agent’s installation path rather than the %TEMP% folder.
This change affects all supported operating systems (Windows, macOS, and Linux). The new paths are as follows:
• Windows: %ProgramData%\CentraStage\Temp, %ProgramData%\CentraStage\AEMAgent\Temp
• macOS and Linux: usr/local/share/CentraStage/Temp, usr/local/share/CentraStage/AEMAgent/Temp

The following operations no longer create or modify files in the %TEMP% folder:

• Script files
• Downloading of Agent Modules packages
• CagService update
• Agent update
• Downloading of Windows Updater file
• Vine VNC setup script file (macOS)
• Screen Capture (macOS)
• Web Remote file transfer

NOTE  If the CagService, Agent, or Web Remote operations are not able to create or use their own Temp directory, all operations above will fallback to using the default %TEMP% folder.

For partners managing devices in environments with rigorous network security, note that the following ports are used by Datto RMM's extended processes, remote tools, and software management. These ports are actively used by the Agent all of the time:

• Port 13300 (UDP) - used for Agent discovery.
• Port 6800 (TCP) - used for Agent communication with the Aria process.

The initial connection between browser and Agent is initialized via WebRTC servers. Refer to WebRTC. Depending on the firewall configuration, the connection will resolve via STUN server (when P2P connection is possible) or TURN server (when Relay connection would be chosen). The WebRTC servers are located in several regions. Refer to Add the following IP addresses and URLS to the allowlist.

The minimum requirements for Web Remote are as follows: outbound port 3478 and ports between 49152 - 65535 should be open (both TCP and UDP) for the IPs listed under IP addresses for the tunnel server grid. In addition, make sure to add the following URL to the allowlist:

Unless a peer-to-peer connection can be established between devices, Agent to Agent connectivity and remote takeover are managed by a tunnel server over an encrypted connection. Tunnel servers are connection relays located around the globe to provide maximum coverage and the best performance depending on your location. They are automatically available to all users.

When a remote takeover session is initiated:

1. The admin device performs a DNS query to find the nearest tunnel server. The tunnel server is picked based on the proximity to the admin device.

2. A connection is made to a load-balanced tunnel server cluster.

3. Finally, a connection is established to the remote device.

To make the most of the tunnel server grid, please ensure that the IP addresses relevant to your geographic location are added to the allowlist and outbound traffic on port 443 is open on your own and your endpoints' firewalls.

The following rules are configured for all local and remote ports:

Rule Name	Protocol	Description	Inbound	Outbound
AEMAgent	ANY	Datto RMM Agent Process
aria2c	ANY	Download manager used by the AEMAgent process
CentraStage_monitor	TCP/UDP	Datto RMM Monitoring Agent
CentraStage_service	TCP/UDP	Datto RMM Agent Service
RMM RTC Proxy	ANY	Datto RMM Web Remote RTC Proxy Service
RMM RTO Proxy	ANY	Datto RMM Web Remote RTO Proxy Service
RMM Web Remote	ANY	Datto RMM Web Remote Process
uVNC_Service	TCP/UDP	uVNC Service for VNC Connections

The Datto RMM Agent communicates with the platform using the IPv4 protocol.

NOTE  IPv6 connections are not supported at this time.

It is strongly recommended that any Stateful Packet Inspection be turned off for access to any centrastage.net address, and that all attempts possible are made to guarantee that TCP connections to the cc.centrastage.net addresses are not terminated in cases of inactivity (these connections may be inactive for up to 180 seconds at a time if no client activity is detected).

To help ease the burden of administration and reduce human error when managing allowlists across multiple firewalls, a series of DNS A records that will return every IP address applicable for a given platform is available. These records are as follows:

• concord-ips.centrastage.net
• vidal-ips.centrastage.net
• zinfandel-ips.centrastage.net
• merlot-ips.centrastage.net
• pinotage-ips.centrastage.net
• syrah-ips.centrastage.net

While the complete list of IP addresses will continue to be available in this article, you may query any of these records to obtain the list of addresses for use in IP-based filtering capable firewalls or scripting purposes.

Querying the DNS A records

To query the DNS A records, use the following commands depending on your operating system:

• Windows: nslookup <platform>-ips.centrastage.net
• Linux: dig <platform>-ips.centrastage.net, host <platform>-ips.centrastage.net, or nslookup <platform>-ips.centrastage.net
• macOS: host <platform>-ips.centrastage.net

For more information, refer to this Community post.

Some countries are not permitted access to the Datto RMM web interface. For more information, refer to Blocklist.