Tools

Ports and Domains/Firewall and AV requirements in Dameware Remote Everywhere (DRE)

Learn how to set up firewall/proxy requirements, what ports need to be allowed for outbound access, what domains need to be accessed, and which components to allow through the AV software

First published date

6/25/2019 5:39 PM

Last published date

2/24/2023 6:37 AM

Overview

This applies to the following requirements below.
  • How to setup Firewall/Proxy requirements for the DRE Tech Console, Agent or Applet
  • What ports need to be allowed for outbound access for DRE
  • What domains need to be accessed
  • Which components to allow through the AV software

Product section

Dameware Remote Everywhere

Resolution

  • This applies to both the technician and the end-user
  • Ports:
    • HTTP (TCP 80)
    • HTTPS (TCP 443)
      • No SSL inspection on TCP 443 for traffic regarding the necessary domains.
      • We validate the HTTPS certificates when communicating with our web servers. So, if the firewall/proxy is intercepting this traffic through a transparent proxy and encrypting it again with the firewall/proxy's certificate, it will fail, and it needs to ensure there is no blocking of DRE domains.
    • UDP 1234 - Bidirectional - Required for P2P connections
    • UDP 1235 - Bidirectional - Required for P2P connections
    • TCP 3377 - Outbound - Fail-over port when 443 is not accessible
 
  • Domains:
    • *.beanywhere.com
    • *.mspa.n-able.com 
    • *.pubnub.com
    • *.swi-tc.com - mandatory for using the Vaults feature and accessing the Admin Area
    • *.swi-rc.com
    • *.swi-dre.com
    • swi-rc.cdn-sw.net
  • Additional notes for Firewalls/Proxies
    • The Agents should be able to reach the internet.
    • No HTTPS snooping should be done on SSL (TCP 443).
      • We validate the HTTPS certificates when communicating with our web servers. So, if the firewall/proxy is intercepting this traffic through a transparent proxy and encrypting it again with the firewall/proxy's certificate, it is going to fail, and it needs to make sure that there is no blocking to the domain *.mspa.n-able.com.
      • Any protocol fingerprinting (some firewalls will interpret non-HTTPS traffic on 443 as malicious), should be no blocking for our domains *.mspa.n-able.com, *.beanywhere.com, *.pubnub.com, *.swi-tc.com, *.swi-rc.com, *.swi-dre.com, and swi-rc.cdn-sw.net
  • The following DRE components below should be allowed by AV (only necessary if being actively blocked by AV)
    • Applet: BASupApp.exe and BASupSrvc.exe
    • Agent: BASupSrvcCnfg.exe and BASupTSHelper.exe
  • ​If you can't connect to any machine from the host (technician side), the DRE component below should be allowed
    • BASEClient.exe