Allowlist requirements for IP addresses and URLs

To help ease the burden of administration and reduce human error when managing allowlists across multiple firewalls, a series of Fully Qualified Domain Names (FQDNs) for DNS A records have been made available. These will return every IP address applicable for a given platform, correct as of the time of the query.

The records for each platform are as follows:

• concord-ips.centrastage.net
• vidal-ips.centrastage.net
• zinfandel-ips.centrastage.net
• merlot-ips.centrastage.net
• pinotage-ips.centrastage.net
• syrah-ips.centrastage.net

Additionally, the Tunnel Server network, which is used for remote takeover, can be added in a similar fashion using the below A Record:

• tunnel-ips.centrastage.net

Provided it is a supported option, the FQDNs for these A Records can be added as required to a firewall's allowlist configuration to permit network access to Datto RMM. This allows the IP addresses used by Datto RMM to change without interrupting coverage or leaving out-of-date entries in the allowlist configuration.

If this method is not available for your firewall, refer to Manual lookup of IP addresses for inbound communication.

Manual lookup of IP addresses for inbound communication

Some networking hardware may not be capable of accepting FQDNs for allowlisting. In this situation, A Records can be polled manually by a computer running any mainstream operating system (OS) for a list of IP addresses accurate as of the time of the query. These IP addresses can then be entered manually into the configuration.

IMPORTANT  As is typical for any cloud-hosted product, Datto RMM's IP addresses change regularly. Ensure you check periodically to confirm the IP addresses you are allowlisting for Datto RMM are up to date.

NOTE  It is recommended that monthly notes are kept of which IP addresses are being manually allowlisted to ensure unused or remnant entries are cleared out.

To query the DNS A records, use the following commands depending on your operating system:

• Windows: nslookup <platform>-ips.centrastage.net
• Linux: dig <platform>-ips.centrastage.net, host <platform>-ips.centrastage.net, or nslookup <platform>-ips.centrastage.net
• macOS: host <platform>-ips.centrastage.net

For more information, refer to this Kaseya Community post.

Some firewalls, proxies, or security appliances may require access to the FQDN of the service as well as any relevant IP addresses.

Wildcards for allowlisting

The most straightforward way to allowlist Datto RMM if you are using a proxy or security appliance is to use the following wildcards: 

• *.centrastage.net
• *.rmm.datto.com

NOTE  If this configuration is not preferred, at a minimum you need to ensure that the relevant FQDNs to your platform are added to the allowlist. Refer to FQDN and IP address details per platform.

FQDN and IP address details per platform

To view platform-specific FQDN and IP address information, use the drop-down below.

Select your platform or choose All Platforms to view platform URLs and IP addresses: Select your platformSyrahVidalMerlotConcordZinfandelPinotageAll Platforms

To allow connectivity to the Datto RMM web interface and between Agents, you must open TCP port 443 outbound through your firewall. For information on all ports needed by Datto RMM, refer to Port usage.

If your company has a more aggressive security posture for outbound traffic (for example, port blocking and IP address access lists), you may need to add a number of IP addresses or URLs to the allowlist in addition to opening port 443 to allow Datto RMM to make the required connections. The IP addresses and URLs you must add to the allowlist are specific to your platform, and you only need to add those associated with your platform.

To learn more about which addresses allow access to the Datto RMM web interface for your platform, refer to IP addresses and FQDNs per platform.

NOTE  For information about the platform your site is hosted on, refer to Datto RMM platforms.

UI access on restricted networks

If accessing the Datto RMM web interface on a restricted network, such as through Microsoft's Global Secure Access, you may need to add allowlisting for one of the following FQDNs, depending on which Datto RMM platform you are on, to access the New UI: 

Platform	FQDN
Pinotage	https://pinotage-frontend-api.centrastage.net
Merlot	https://merlot-frontend-api.centrastage.net
Concord	https://concord-frontend-api.centrastage.net
Vidal	https://vidal-frontend-api.centrastage.net
Zinfandel	https://zinfandel-frontend-api.centrastage.net
Syrah	https://syrah-frontend-api.centrastage.net

For information on all FQDNs that may need to be allowlisted for access to the Datto RMM web interface, and more, refer to IP addresses and FQDNs per platform.

Datto RMM initializes the connection between browser and Agent via WebRTC servers. Refer to WebRTC. Depending on the firewall configuration, the connection will resolve via STUN server (when P2P connection is possible) or TURN server (when relay connection would be chosen). The WebRTC servers are located in several regions. Refer to FQDNs/DNS A records.

The minimum requirements for Web Remote are as follows: outbound port 3478 and ports between 49152 and 65535 should be open (both TCP and UDP) for the tunnel server DNS A record listed in FQDNs/DNS A records. For information on all ports needed by Datto RMM, refer to Port usage.

The following URLs need to be added to the allowlist:

IMPORTANT  In addition, all DigiCert certificate status IPv4 addresses need to be allowed outbound access. The list of IP addresses and domains that need this access is located in the DigiCert Certificate Status IP Addresses article. There is a link to download a spreadsheet of this information at the bottom of the linked page.

Datto RMM uses several ports for various functions. All of the ports needed and their functions are listed below.

Inbound and outbound rules

The following rules are configured for all local and remote ports:

Rule name	Protocol	Description	Inbound	Outbound
AEMAgent	ANY	Datto RMM Agent Process
CentraStage_monitor	TCP/UDP	Datto RMM Monitoring Agent
CentraStage_service	TCP/UDP	Datto RMM Agent Service
RMM RTC Proxy	ANY	Datto RMM Web Remote RTC Proxy Service
RMM RTO Proxy	ANY	Datto RMM Web Remote RTO Proxy Service
RMM Web Remote	ANY	Datto RMM Web Remote Process
uVNC_Service	TCP/UDP	uVNC Service for VNC Connections

For partners using Advanced Software Management, the following URL must not be blocked for the feature to function correctly: 

URL: 

• smpm.kaseya.com

IMPORTANT  Advanced Software Management does not currently support proxy-configured Datto RMM agents.

Refer to Advanced Software Management.

If you are integrated with Datto AV, add the following URLs to the allowlist to allow installation: 

• hunt-saas-files.s3.us-east-1.amazonaws.com
• hunt-saas-surveys.s3.us-east-1.amazonaws.com
• infocyte-downloads.s3.us-east-1.amazonaws.com

For information on integrating Datto AV with Datto RMM, refer to Datto Endpoint Security Integration.

Certain TLS 1.2 Cipher Suites, which are typically enabled by default on Windows operating systems but can be manually disabled, must be enabled on Windows Servers for the Datto RMM Agent to connect.

Datto RMM utilizes Amazon CloudFront for connections and currently follows the security policy TLSv1.2_2019. When enabled, the following TLS Cipher Suites allow the Datto RMM Agent to connect:

• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

Refer to Supported protocols and ciphers between viewers and CloudFront in the Amazon CloudFront Developer Guide.

IMPORTANT  To reduce security false positives, improve monitoring and automation reliability, and make the Agent's allowlisting more comprehensive, a temporary directory is used underneath the Datto RMM Agent's installation path rather than the %TEMP% folder.
These paths are as follows:
• Windows: %ProgramData%\CentraStage\Temp, %ProgramData%\CentraStage\AEMAgent\Temp
• macOS and Linux: usr/local/share/CentraStage/Temp, usr/local/share/CentraStage/AEMAgent/Temp

The following operations by default do not create or modify files in the %TEMP% folder:

• Script files
• Downloading of Agent Modules packages
• CagService update
• Agent update
• Downloading of Windows Updater file
• Vine VNC setup script file (macOS)
• Screen Capture (macOS)
• Web Remote file transfer

NOTE  If the CagService, Agent, or Web Remote operations are not able to create or use their own Temp directory, all operations above will fall back to using the default %TEMP% folder.

Unless a peer-to-peer connection can be established between devices, Agent to Agent connectivity and remote takeover are managed by a tunnel server over an encrypted connection. Tunnel servers are connection relays located around the globe to provide maximum coverage and the best performance depending on your location. They are automatically available to all users.

When a remote takeover session is initiated:

1. The admin device performs a DNS query to find the nearest tunnel server. Datto RMM picks the tunnel server based on the proximity to the admin device.

   NOTE  When connecting to a device via Web Remote, Datto RMM picks the tunnel server based on proximity to the remote device instead of the admin device.

2. A connection is made to a load-balanced tunnel server cluster.

3. A connection is established to the remote device.

To make the most of the tunnel server grid, ensure that the IP addresses relevant to your geographic location are added to the allowlist and outbound traffic on port 443 is open on your own and your endpoints' firewalls.

When working with antivirus solutions, such as Datto AV, there may be a need to exclude certain files or folders that Datto RMM uses to ensure it behaves consistently.

Excluding the following locations from being targeted by your AV policy can help prevent it from flagging Datto RMM as unwanted or malicious: 

• Datto RMM folder paths:
  • C:\Program Files (x86)\CentraStage\
  • C:\ProgramData\CentraStage\
• Datto RMM executable paths:
  • C:\Program Files (x86)\CentraStage\CagService.exe
  • C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe
  • C:\Program Files (x86)\CentraStage\gui.exe
  • C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\*\RMM.WebRemote.exe
  • C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\*\RMM.RTC.Proxy\RMM.RTC.Proxy.exe

IMPORTANT  While this is a proven list of known locations to exclude for Datto AV, your antivirus configuration may differ. Always check the AV developer documentation for recommended best practices before making any changes.

IMPORTANT  If your antivirus product has flagged the Datto RMM Agent installer as malicious, contact your antivirus provider and request that they mark the installer as a false positive to allow it through.

Datto AV exclusions

When Datto AV is deployed alongside Datto RMM, allowlisting the folder and file paths listed above may be necessary to avoid conflicts and to ensure it behaves consistently.

To learn more, refer to Working with exclusions in your Datto AV policy in the Datto EDR help documentation.

Microsoft Defender exclusions

Organizations using Microsoft Defender Antivirus or Microsoft Defender for Endpoint should review Microsoft's guidance for configuring antivirus exclusions and attack surface reduction (ASR) exclusions. Microsoft provides centralized management through Microsoft Intune, Group Policy, Configuration Manager, and the Microsoft Defender portal.

Microsoft documentation links:

• Microsoft Defender Antivirus exclusions: Configure and validate exclusions based on file extension and folder location. Also applies to Microsoft Defender for Endpoint.
• Attack Surface Reduction (ASR) rules: Attack surface reduction (ASR) rules reference for Microsoft Defender for Endpoint.

For information on how to obtain a list of inbound and tunnel server IP addresses for Datto RMM, refer to FQDNs/DNS A records.

If you are downloading and running components from the ComStore, add storage.centrastage.net and storage.rmm.datto.com to the allowlist. Additionally, if you use any of the following software applications either as a ComStore component or via Software Management, make sure to add the relevant URL(s) to the allowlist: