Ports used by the system
XProtect components communicate over the network by using the ports and protocols described in this topic. Use this information when configuring firewalls and network access between XProtect components, clients, integrations, hardware devices, and external services.
Enable only the communication required by the components, features, and integrations in your deployment. The tables also include local communication between processes on the same computer. Local communication does not normally require a cross-host firewall rule.
Port numbers are defaults unless otherwise stated. Some ports can be changed through the product configuration.
You can look up communication in two ways:
Communication by listener identifies the service that accepts a connection, the systems that initiate the connection, and the transport and application protocols used.
View by component computer summarizes the inbound, outbound, and local communication associated with a specific XProtect component computer.
The communication required in a deployment depends on the installed components, enabled features, configured integrations, and deployed hardware devices.
How to read the tables
Firewall use identifies when the communication is required and whether a cross-host firewall rule is relevant.
Local only means that the connection is restricted to processes on the same computer and does not require a cross-host firewall rule.
Intended for same-computer communication means that the product uses the connection between services on the same computer, but the listener might not be restricted to the loopback interface. Do not allow cross-host access when the table instructs you to block it.
Configured means that the deployment configuration determines the actual scheme, address, or port.
Installing certificates does not automatically change every communication channel to HTTPS or TLS. Follow the protocol behavior specified for each listener.
The listener view is organized by the computer on which a service accepts connections. To determine which inbound firewall rules are required on a computer, consider all XProtect services installed on that computer.
Do not open every port listed in this topic. Open a port only when the corresponding component or feature is installed, enabled, and required in the deployment.
Listener table columns
Initiator is the client, component, process, integration, or external system that opens the connection.
Listener is the service that accepts the connection.
Without certificates describes the application protocol used when certificate-based transport security is not enabled for that interface.
With certificates describes the application protocol used when certificate-based transport security is enabled for that interface.
Purpose describes the function provided by the listener.
The management server computer hosts the Management Server web services, Identity Provider, OpenTelemetry Collector, VictoriaLogs, and optional IIS-hosted services such as XProtect Incident Manager . By default, the computer also hosts the API Gateway.
Port | Transport | Initiator | Listener | Without certificates | With certificates | Firewall use | Purpose |
|---|---|---|---|---|---|---|---|
80, default | TCP | XProtect clients, XProtect server components, and integrations | Management Server web services, Identity Provider, API Gateway, and optional IIS-hosted services | HTTP | HTTP remains available for supported HTTP endpoints | Cross-host. Allow from clients, components, and integrations that require HTTP-based access to Management Server services or Identity Provider services. Restrict access to trusted management networks. | Provides discovery, authentication, registration, configuration, monitoring data, state updates, management server APIs, and optional IIS-hosted services, including XProtect Incident Manager . |
443, default | TCP | XProtect clients, XProtect server components, and integrations | Management Server web services, Identity Provider, API Gateway, and optional IIS-hosted services | Not applicable | HTTPS | Cross-host. Allow from clients, components, and integrations that require access to Management Server services or Identity Provider services over HTTPS. | Provides authentication, registration, configuration, monitoring data, state updates, management server APIs, and optional IIS-hosted services, including XProtect Incident Manager . |
4318 | TCP | XProtect server components and the API Gateway installed on the management server computer | OpenTelemetry Collector | OTLP/HTTP | OTLP/HTTP | Intended for same-computer communication. Do not allow cross-host access through the firewall. | Receives logs from XProtect server components and the API Gateway installed on the management server computer. |
6473 | TCP | Management Server Manager tray process | Management Server | Loopback gRPC | Loopback gRPC | Local only. No cross-host firewall rule is required. | Provides local Management Server status and service management. |
8080 | TCP | Local management server process | Management Server internal service | Loopback HTTP/WCF | Loopback HTTP/WCF | Local only. No cross-host firewall rule is required. | Supports communication between internal management server processes. |
9000 | TCP | Recording server, including an active failover recording server | Management Server ’s Recording Server Web API | HTTP | HTTPS | Cross-host. Required for communication between recording servers and the management server. Allow from recording server computers. | Recording server registration, status and log transfer, configuration exchange, and command responses. |
9428 | TCP | OpenTelemetry Collector and API Gateway installed on the management server computer | VictoriaLogs system-log service | HTTP OTLP ingestion and HTTP query access | HTTP OTLP ingestion and HTTP query access | Intended for same-computer communication. Do not allow cross-host access through the firewall. | Stores and provides query access to system logs. |
9429 | TCP | OpenTelemetry Collector and API Gateway installed on the management server computer | VictoriaLogs audit-log service | HTTP OTLP ingestion and HTTP query access | HTTP OTLP ingestion and HTTP query access | Intended for same-computer communication. Do not allow cross-host access through the firewall. | Stores and provides query access to audit logs. |
9430 | TCP | OpenTelemetry Collector and API Gateway installed on the management server computer | VictoriaLogs rule-log service | HTTP OTLP ingestion and HTTP query access | HTTP OTLP ingestion and HTTP query access | Intended for same-computer communication. Do not allow cross-host access through the firewall. | Stores and provides query access to rule logs. |
12974 | TCP | Local Windows SNMP extension bridge | Management Server | Loopback .NET Remoting | Loopback .NET Remoting | Local only. Used when the SNMP extension is enabled. No cross-host firewall rule is required. | Connects the local Windows SNMP extension bridge to the management server. |
Management Server web-service ports
The configured Management Server URI determines the scheme, host, and port used by XProtect clients, server components, and integrations. Ports 80 and 443 are the defaults.
The table does not enumerate every system that can use the Management Server web services. Installed components, enabled features, and configured integrations determine which systems require access.
Installing certificates does not restrict port 80 to discovery or other well-known endpoints only. Supported HTTP endpoints remain available according to their endpoint configuration. Endpoints configured for transport security use HTTPS.
Caution
Restrict access to Management Server port 80 to trusted management networks.
Logs
The OpenTelemetry Collector and VictoriaLogs are used for log processing and storage on the management server computer.
Ports 4318 and 9428 through 9430 are used for communication between logging services on the management server computer. Do not allow cross-host access to these local listeners through the firewall.
XProtect components on other computers submit and retrieve logs through the API Gateway installed on the management server computer.
XProtect can also forward logs to a configured external monitoring or logging solution by using OTLP. The standard destination port is 4317 for OTLP over gRPC or 4318 for OTLP over HTTP. Allow outbound traffic only to the endpoint and port required by the configured monitoring solution.
The recording server accepts connections from XProtect clients, server components, integrations, and Failover Server services. Some listeners are optional or used only when a corresponding feature, device driver, or failover function is enabled.
Port | Transport | Initiator | Listener | Without certificates | With certificates | Firewall use | Purpose |
|---|---|---|---|---|---|---|---|
5210 | TCP | Recording server | Recording Server media database service | Proprietary TCP protocol with authentication | Proprietary TCP protocol with authentication over TLS | Cross-host. Allow between applicable recording server and failover recording server computers when access to recorded media on another server is required. | Provides access to recorded media that remains on the Recording Server after a device has been moved to another Recording Server . |
5432, configurable | TCP | Configured driver or device | Recording Server driver-alert listener | Plain TCP without authorization | Plain TCP without authorization | Disabled by default. Allow only from devices or drivers that require this listener. Restrict permitted source hosts. | Receives legacy driver alerts and events. |
7563 | TCP | XProtect clients, XProtect server components, interconnected sites, and integrations that retrieve data from the recording server | Recording Server media and command services | Custom HTTP/Image Server and SOAP over TCP | The same services over TLS | Cross-host. Allow from clients, components, sites, and integrations that retrieve data or use Recording Server services. | Provides video, audio, metadata, JPEG retrieval, PTZ, speaker audio, events and status, outputs, and recording commands. |
8966 | TCP | Recording Server Manager tray process | Recording Server | Loopback gRPC | Loopback gRPC | Local only. No cross-host firewall rule is required. | Provides local Recording Server status and service management. |
9001 | TCP | Management server | Recording Server Web API | HTTP | HTTPS | Cross-host. Allow from the management server computer. | Provides management server -to- recording server commands, configuration, and status communication. |
11000 | TCP | Failover Server service | Recording Server failover-response service | Custom framed TCP | TLS | Cross-host. Allow from applicable failover server computers when failover is configured. | Supports health polling and failover-control messages. |
12975 | TCP | Local Windows SNMP extension bridge | Recording Server | Loopback .NET Remoting | Loopback .NET Remoting | Local only. Used when the SNMP extension is enabled. No cross-host firewall rule is required. | Connects the local Windows SNMP extension bridge to the recording server. |
65101, incremented if occupied | UDP | Local driver process | Recording Server driver-event listener | UDP | UDP | Local only. No cross-host firewall rule is required. | Receives local event notifications from device drivers. |
A failover recording server computer has two services installed:
The Failover Server service, which monitors the relevant recording servers and manages failover.
The Failover Recording Server service, which enables the computer to take over recording server functions.
The listener table includes communication for both services.
Port | Transport | Initiator | Listener | Without certificates | With certificates | Firewall use | Purpose |
|---|---|---|---|---|---|---|---|
5210 | TCP | Recording server | Failover Recording Server media database service | Proprietary TCP protocol with authentication | Proprietary TCP protocol with authentication over TLS | Cross-host. Allow from the applicable recording server when access to recorded media stored on the failover recording server is required. | Provides access to recorded media that was stored on the failover recording server during a failover event. |
7563 | TCP | XProtect clients, XProtect server components, interconnected sites, and integrations that retrieve data from the active failover recording server | Active Failover Recording Server media and command services | Custom HTTP/Image Server and SOAP over TCP | The same services over TLS | Cross-host. Used while the failover recording server is active. Allow from systems that retrieve media or use Recording Server services. | Provides video, audio, metadata, JPEG retrieval, PTZ, speaker audio, events and status, outputs, and recording commands. |
8844 | UDP | Peer Failover Server services | Failover Server service | Plain UDP | Plain UDP | Cross-host. Allow between failover server computers in the same failover group. Each Failover Server service both sends and listens on this port. | Exchanges peer and group status information between Failover Server services. |
8966 | TCP | Failover Recording Server Manager tray process | Failover Recording Server service | Loopback gRPC | Loopback gRPC | Local only. No cross-host firewall rule is required. | Provides local Failover Recording Server status and service management. |
8967 | TCP | Failover Server Manager tray process | Failover Server service | Loopback gRPC | Loopback gRPC | Local only. No cross-host firewall rule is required. | Provides local Failover Server service status and service management. |
8990 | TCP | Management server | Failover Server service status API | HTTP | HTTPS | Cross-host. Allow from the management server computer. | Provides Failover Server service status information to the management server. |
9001 | TCP | Management server | Active Failover Recording Server Web API | HTTP | HTTPS | Cross-host. Used while the failover recording server is active. Allow from the management server computer. | Provides management server -to- recording server commands, configuration, and status communication. |
11000 | TCP | Failover Server service | Failover Recording Server failover-response service | Custom framed TCP | TLS | Local only. The Failover Server service and Failover Recording Server service are installed on the same failover recording server computer. No cross-host firewall rule is required. | Supports health polling and failover-control messages. |
The event server provides services for events, alarms, maps, messaging, and supported integrations.
Generic Events and Analytics Events listeners are disabled by default. Enable only the listeners and data sources required by the deployment. These interfaces do not automatically become encrypted when certificates are installed.
Port | Transport | Initiator | Listener | Without certificates | With certificates | Firewall use | Purpose |
|---|---|---|---|---|---|---|---|
1234, configurable | TCP and/or UDP | External Generic Events sender | Event Server Generic Events listener | TCP and/or UDP | TCP and/or UDP | Disabled by default. Allow only from systems that send Generic Events. The listener does not use HTTPS, authentication, or authorization. | Receives Compatible Generic Events from external systems or devices. |
1235, configurable | TCP | External Generic Events sender | Event Server Generic Events listener | TCP | TCP | Disabled by default. Allow only from systems that send Generic Events. The listener does not use HTTPS, authentication, or authorization. | Receives International Generic Events from external systems or devices. |
9090, configurable | TCP | External Analytics Events sender | Event Server Analytics Events listener | TCP using raw XML or an HTTP-like POST | TCP using raw XML or an HTTP-like POST | Disabled by default. Allow only from configured Analytics Events sources. The security option is a source-host allow list, not TLS. | Receives Analytics Events from external systems or devices. |
22331 | TCP | XProtect clients and integrations | Event Server WCF services | HTTP WCF/SOAP | HTTPS WCF/SOAP | Cross-host. Allow from clients and integrations that require Event Server WCF services. | Provides configuration, alarms, maps, status, actions, and related Event Server services. |
22332 | TCP | API Gateway, Management Client , and supported direct API clients | Event Server REST and WebSocket services | HTTP and WS | HTTPS and WSS | Cross-host. Allow from API Gateway and clients that use the supported REST or WebSocket interfaces. | Provides event and state subscriptions, Events REST, Alarms REST, and WebSocket Messaging APIs. |
22333 | TCP | MIP plug-ins and applications | Event Server legacy MIP message service | Net.TCP with | Listener is not used; secure MIP communication uses HTTPS on port 22331 | Used only without encryption. Allow from applicable MIP applications. | Provides legacy MIP filter, registration, transmission, reception, and messaging functions. |
Additional administrator-configured Generic Events ports are not listed in this overview. If you configure an additional Generic Events data source, configure the corresponding firewall access as described in the Generic Events documentation.
API Gateway is installed on the management server computer by default and can also be installed on separate computers. A deployment can contain multiple API Gateway instances.
Only the API Gateway installed on the management server computer provides log submission and retrieval.
Port | Transport | Initiator | Listener | Without certificates | With certificates | Firewall use | Purpose |
|---|---|---|---|---|---|---|---|
Configured IIS HTTP port, normally 80 | TCP | API clients, XProtect clients, XProtect server components, and integrations | API Gateway through IIS | HTTP and WS | Not applicable | Cross-host. Allow from systems that require the API Gateway over HTTP. Restrict access according to the deployment security policy. | Provides Gateway REST, WebSocket, WebRTC, Management proxy, and Event proxy services. The API Gateway installed on the management server computer also provides log submission and retrieval. |
Configured IIS HTTPS port, normally 443 | TCP | API clients, XProtect clients, XProtect server components, and integrations | API Gateway through IIS | Not applicable | HTTPS and WSS | Cross-host. Allow from systems that require the API Gateway over HTTPS. | Provides transport-secured Gateway REST, WebSocket, WebRTC, Management proxy, and Event proxy services. The API Gateway installed on the management server computer also provides log submission and retrieval. |
The configured IIS bindings determine the actual HTTP and HTTPS ports used by API Gateway. Open only the binding required by the deployment and restrict access to trusted clients, components, and integrations.
The management server initiates connections to the Data Collector on each monitored computer. The Data Collector separately initiates communication to the configured Management Server web-service endpoint, as shown in the component-computer view.
Port | Transport | Initiator | Listener | Without certificates | With certificates | Firewall use | Purpose |
|---|---|---|---|---|---|---|---|
7609 | TCP | Management server | Data Collector on each monitored computer | gRPC over HTTP | gRPC over HTTPS | Cross-host. Allow from the management server computer to each monitored computer. | Provides live performance counters and monitoring information for System Monitor. |
Mobile Server provides separate, independently configurable HTTP and HTTPS listeners for XProtect Mobile client, XProtect Web Client, and supported Mobile Server administration functions.
Video Push uses a separate configurable listener for communication from the recording server. The Video Push listener is disabled by default.
Port | Transport | Initiator | Listener | Without certificates | With certificates | Firewall use | Purpose |
|---|---|---|---|---|---|---|---|
8081, configurable | TCP | XProtect Mobile client, XProtect Web Client, Management Client | Mobile Server | HTTP | Remains HTTP if the listener is enabled | Cross-host. Allow from clients that use the unsecured Mobile Server interface. | Provides client commands and video and audio delivery. |
8082, configurable | TCP | XProtect Mobile client, XProtect Web Client, Management Client | Mobile Server | Not applicable | HTTPS | Cross-host. Allow from clients that use the secured Mobile Server interface. | Provides transport-secured client commands and video and audio delivery. |
40001 + channel index, configurable | TCP | Recording server | Mobile Server Video Push media-provider listener | TCP with HTTP-like MIP media-provider framing | TCP with HTTP-like MIP media-provider framing | Disabled by default. Allow from applicable recording server computers when Video Push is enabled. | Provides the recording server with access to a Video Push virtual-camera feed. |
XProtect LPR Server is installed as part of an XProtect LPR deployment. The event server requires the XProtect LPR plug-in to communicate with the LPR Server.
The LPR Server listener port is configurable. If certificate-based event server communication is enabled, configure the LPR components to use the secured interface.
Port | Transport | Initiator | Listener | Without certificates | With certificates | Firewall use | Purpose |
|---|---|---|---|---|---|---|---|
22334, configurable | TCP | Event server LPR plug-in, supported administration clients, and the local LPR Server Manager tray icon | LPR Server WCF service | HTTP WCF | HTTPS WCF | Cross-host. Allow from the event server computer and supported administration computers when XProtect LPR is installed. | Provides LPR Server status, recognized-license-plate results, commands, configuration, and JPEG-analysis requests. |
Milestone Open Network Bridge provides ONVIF and RTSP interfaces for supported third-party clients.
WS-Discovery is optional and disabled by default. Media can be transported over the RTSP TCP connection or by using negotiated RTP and RTCP UDP ports, as shown in the component-computer view.
Port | Transport | Initiator | Listener | Without certificates | With certificates | Firewall use | Purpose |
|---|---|---|---|---|---|---|---|
554, configurable | TCP | ONVIF and RTSP clients | Milestone Open Network Bridge RTSP service | RTSP over TCP | RTSP over TCP | Cross-host. Allow from ONVIF or RTSP clients that retrieve media through the bridge. | Provides RTSP session control. RTP and RTCP can be interleaved over the RTSP TCP connection. |
580, configurable | TCP | ONVIF clients | Milestone Open Network Bridge ONVIF service | HTTP/SOAP | HTTPS/SOAP | Cross-host. Allow from ONVIF clients that require access to the bridge. | Provides ONVIF authentication, device and media services, PTZ operations, events, searches, replay control, and video-stream configuration. |
3702 | UDP | WS-Discovery client | Milestone Open Network Bridge discovery service | WS-Discovery | WS-Discovery | Cross-host, optional, and disabled by default. Allow only when ONVIF WS-Discovery is enabled. | Enables ONVIF clients to discover Milestone Open Network Bridge . |
XProtect Smart Client normally initiates connections to XProtect server components. When XProtect Smart Client is configured as a Matrix recipient, the XProtect Smart Client computer also accepts inbound Matrix commands from the management server.
The Matrix recipient listener is disabled by default and uses a configurable TCP port.
Port | Transport | Initiator | Listener | Without certificates | With certificates | Firewall use | Purpose |
|---|---|---|---|---|---|---|---|
12345 by default, configurable | TCP | Management server | XProtect Smart Client Matrix recipient | Plain TCP | Plain TCP | Disabled by default. Allow from the management server computer when the XProtect Smart Client computer is configured as a Matrix recipient. | Receives Matrix connect, disconnect, and view commands. |
The component-computer view summarizes the inbound, outbound, and local communication associated with each XProtect component computer or client.
Use this view when configuring firewall rules for a specific computer. A server component can both accept connections and initiate connections to other XProtect components, external services, integrations, or hardware devices.
For application protocol and certificate behavior, follow the link in the Details column to the corresponding entry under Communication by listener . A dash in the Details column indicates that the peer is an external or configuration-dependent destination for which this topic does not define the listener.
Open only the communication required by installed components, enabled features, configured integrations, and deployment-specific destinations.
Component-computer table columns
Direction identifies whether the connection is inbound to, outbound from, or local to the component computer.
Peer component or system identifies the computer, client, integration, hardware device, or external system at the other end of the connection.
Peer service identifies the service or interface at the other end of the connection.
Details links to the corresponding listener entry when that listener is documented in this topic. A dash indicates an external or configuration-dependent destination for which this topic does not define the listener.
Purpose describes why the component computer uses the connection.
The management server computer hosts the Management Server services, Identity Provider, OpenTelemetry Collector, VictoriaLogs, and optional IIS-hosted services such as XProtect Incident Manager . By default, the computer also hosts an API Gateway.
API Gateway is documented in a separate component view because it can also be installed on another computer. The management server computer view includes the OpenTelemetry Collector and VictoriaLogs listeners hosted on the management server computer. The API Gateway component view shows the corresponding local communication initiated by the API Gateway installed on that computer.
Direction | Port / transport | Peer component or system | Peer service | Firewall use | Purpose | Details |
|---|---|---|---|---|---|---|
Inbound | 80/TCP, default | XProtect clients, XProtect server components, and integrations | Management Server web services, Identity Provider, API Gateway, and optional IIS-hosted services | Allow from systems that require HTTP-based Management Server services. Restrict access to trusted management networks. | Provides discovery, authentication, registration, configuration, monitoring data, state updates, management server APIs, and optional IIS-hosted services, including XProtect Incident Manager . | |
Inbound | 443/TCP, default | XProtect clients, XProtect server components, and integrations | Management Server web services, Identity Provider, API Gateway, and optional IIS-hosted services | Allow from systems that require Management Server or Identity Provider services over HTTPS. | Provides authentication, registration, configuration, monitoring data, state updates, management server APIs, and optional IIS-hosted services, including XProtect Incident Manager . | |
Inbound | 9000/TCP | Recording servers, including active failover recording servers | Management server's recording server Web API | Allow from recording server computers. | Recording server registration, status and log transfer, configuration exchange, and command responses. | |
Outbound | 25/TCP by default, configurable | Configured SMTP server | SMTP server | Allow from the management server computer to the configured SMTP server when email notifications are configured. | Sends email notifications. TLS use depends on the SMTP configuration. | — |
Outbound | 443/TCP |
| License Management service at | Allow when online or automatic license activation is used. | Activates licenses. | — |
Outbound | Configured SQL endpoint/TCP, conventionally 1433 | Configured SQL Server | SQL Server | Allow from the management server computer to the configured SQL Server endpoint. | Stores and retrieves product configuration and other management server database information. The configured SQL instance and connection string determine the actual destination and port. | — |
Outbound | 4317/TCP, or the configured destination port | Administrator-configured external monitoring or logging solution | OTLP over gRPC endpoint | Required only when an administrator configures the OpenTelemetry Collector to forward logs to an external OTLP over gRPC endpoint. Allow only to the configured destination address and port. | The OpenTelemetry Collector forwards logs to the configured external monitoring or logging solution by using OTLP over gRPC. | — |
Outbound | 4318/TCP, or the configured destination port | Administrator-configured external monitoring or logging solution | OTLP over HTTP endpoint | Required only when an administrator configures the OpenTelemetry Collector to forward logs to an external OTLP over HTTP endpoint. Allow only to the configured destination address and port. | The OpenTelemetry Collector forwards logs to the configured external monitoring or logging solution by using OTLP over HTTP. | — |
Outbound | 7609/TCP | Each monitored computer | Data Collector | Allow from the management server computer to each monitored computer. Required for System Monitor data collection. | Queries live performance counters and monitoring information. | |
Outbound | 8990/TCP | Failover server computer | Failover Server service status API | Allow from the management server computer to each failover server computer when failover server is installed. | Monitors the status of the Failover Server service. | |
Outbound | 9001/TCP | Recording server computer | Recording server Web API | Allow from the management server computer to each managed recording server. | Sends commands and exchanges configuration and status information. | |
Outbound | 12345/TCP by default, configurable | Configured Matrix recipient | Matrix recipient, typically XProtect Smart Client | Allow from the management server computer to configured Matrix recipients when Matrix is used. | Sends Matrix connect, disconnect, and view commands using plain TCP. | |
Local | 4318/TCP | XProtect server components and the API Gateway installed on the management server computer | OpenTelemetry Collector | Intended for same-computer communication. Do not allow cross-host access through the firewall. | Receives logs through OTLP/HTTP. | |
Local | 6473/TCP | Management Server Manager tray process | Management Server | Local only. No cross-host firewall rule is required. | Provides local management server status and service management. | |
Local | 8080/TCP | Local management server process | Management Server internal service | Local only. No cross-host firewall rule is required. | Supports communication between internal manaement server processes. | |
Local | 9428/TCP | OpenTelemetry Collector and API Gateway installed on the management server computer | VictoriaLogs system-log service | Intended for same-computer communication. Do not allow cross-host access through the firewall. | Stores and provides query access to system logs. | |
Local | 9429/TCP | OpenTelemetry Collector and API Gateway installed on the management server computer | VictoriaLogs audit-log service | Intended for same-computer communication. Do not allow cross-host access through the firewall. | Stores and provides query access to audit logs. | |
Local | 9430/TCP | OpenTelemetry Collector and API Gateway installed on the management server computer | VictoriaLogs rule-log service | Intended for same-computer communication. Do not allow cross-host access through the firewall. | Stores and provides query access to rule logs. | |
Local | 12974/TCP | Local Windows SNMP extension bridge | Management Server | Local only. Used when the SNMP extension is enabled. No cross-host firewall rule is required. | Connects the local Windows SNMP extension bridge to the management server. |
The recording server communicates with the management server, clients, Failover Server services, interconnected sites, Mobile Server, and deployed hardware devices.
Communication with cameras, NVRs, encoders, I/O devices, and other hardware devices depends on the device, driver, enabled functions, selected media transport, and device configuration. Allow only the ports and protocols required by the deployed hardware. For device-specific network requirements, consult the device manufacturer’s documentation.
For information about supported devices, drivers, firmware, and capabilities, see the Supported devices.
Direction | Port / transport | Peer component or system | Peer service | Firewall use | Purpose | Details |
|---|---|---|---|---|---|---|
Inbound | 5210/TCP | Recording server that requires access to the recorded media | Recording Server media database service | Allow between applicable recording server computers where access to recorded media on another recording server is required. | Provides access to recorded media that remains on the recording server after a device has been moved to another recording server. | |
Inbound | 5432/TCP, configurable | Configured driver or device | Recording Server driver-alert listener | Disabled by default. Allow only from required and trusted source hosts. | Receives legacy driver alerts and events. | |
Inbound | 7563/TCP | XProtect clients, XProtect server components, interconnected sites, and integrations | Recording Server media and command services | Allow from systems that retrieve media or use supported Recording Server services. | Provides video, audio, metadata, commands, status, outputs, and recording operations. | |
Inbound | 9001/TCP | Management server computer | Recording Server Web API | Allow from the management server computer. | Receives management server commands and exchanges configuration and status information. | |
Inbound | 11000/TCP | Failover server computer | Recording Server failover-response service | Allow from applicable failover server computers when failover is configured. | Supports health polling and failover-control messages. | |
Outbound | 80 or 443/TCP, configured management server URI | Management server computer | Management Server web services and Identity Provider | Allow to the configured management server URI. | Supports authentication, discovery, registration, configuration, and Management Server services. | |
Outbound | 5210/TCP | Recording server or failover recording server computer hosting the required media | Recording Server media database service | Allow when the recording server requires access to recorded media stored on another recording server or failover recording server. | Accesses recorded media stored on another recording server or failover recording server. | Recording server computer listeners / Failover recording server computer listeners |
Outbound | 7563/TCP, configured destination | Remote interconnected site | Remote Recording Server media and command service | Allow when XProtect Interconnect is configured. | Transfers supported media, events, status, and commands between interconnected sites. | |
Outbound | 9000/TCP | Management server computer | Management server's recording server Web API | Allow from the recording server computer to the management server computer. | Sends registration, status, logs, configuration responses, and command responses. | |
Outbound | 40001 + channel index/TCP, configurable | Mobile Server computer | Mobile Server Video Push media-provider listener | Disabled by default. Allow when Video Push is enabled. | Connects to the Mobile Server to provide a Video Push virtual-camera feed. | |
Outbound | Device-configured | Cameras, NVRs, encoders, I/O devices, and other hardware devices | Device services | Allow only the ports and protocols required by the deployed devices, drivers, and enabled device functions. | Supports device authentication, configuration, media, metadata, events, audio, PTZ, I/O, and other device functions. | Consult the device manufacturer’s documentation. |
Local | 8966/TCP | Recording Server Manager tray process | Recording Server | Local only. No cross-host firewall rule is required. | Provides local status and service management. | |
Local | 12975/TCP | Local Windows SNMP extension bridge | Recording Server | Local only. Used when the SNMP extension is enabled. | Connects the local Windows SNMP extension bridge to the recording server. | |
Local | 65101/UDP, incremented if occupied | Local driver process | Recording Server driver-event listener | Local only. No cross-host firewall rule is required. | Receives event notifications from device drivers. |
A failover recording server computer has the Failover Server service and the Failover Recording Server service installed.
The Failover Server service monitors the applicable recording servers and manages failover. The Failover Recording Server service enables the computer to take over recording server functions.
The table includes communication for both services. Device and media communication is used while the failover recording server has taken over recording server functions. Monitoring and coordination communication can remain active independently of a failover.
Direction | Port / transport | Peer component or system | Peer service | Firewall use | Purpose | Details |
|---|---|---|---|---|---|---|
Inbound | 5210/TCP | Recording server that requires access to the recorded media | Failover Recording Server media database service | Allow when access to recorded media stored on the failover recording server is required. | Provides access to recorded media that was stored on the failover recording server during a failover event. | |
Inbound | 7563/TCP | XProtect clients, XProtect server components, interconnected sites, and integrations | Active Failover Recording Server media and command services | Allow while the failover recording server is active from systems that retrieve media or use Recording Server services. | Provides video, audio, metadata, commands, status, outputs, and recording operations. | |
Inbound | 8844/UDP | Peer failover server computers | Failover Server service | Allow between failover server computers in the same failover group. | Receives peer and group status information. | |
Inbound | 8990/TCP | Management server computer | Failover Server service status API | Allow from the management server computer. | Provides Failover Server service status information. | |
Inbound | 9001/TCP | Management server computer | Active Failover Recording Server Web API | Allow from the management server computer while the failover recording server is active. | Receives commands and exchanges configuration and status information. | |
Outbound | Configured management server URI/TCP, normally 80 or 443 | Management server computer | Management Server web services and Identity Provider | Allow to the configured management server URI. | Supports authentication, discovery, registration, configuration, and Management Server services. | |
Outbound | 8844/UDP | Peer failover server computers | Peer Failover Server services | Allow between failover server computers in the same failover group. | Sends peer and group status information. | |
Outbound | 9000/TCP | Management server computer | Management server's recording server Web API | Allow from the active failover recording server to the management server computer. | Sends registration, status, logs, configuration responses, and command responses while active. | |
Outbound | 11000/TCP | Recording server computers | Recording Server failover-response service | Allow to each recording server monitored by the Failover Server service. | Polls recording server health and sends failover-control messages. | |
Outbound | Device-configured | Cameras, NVRs, encoders, I/O devices, and other hardware devices | Device services | Allow only the ports and protocols required by the deployed devices, drivers, and enabled device functions. | Supports device authentication, configuration, media, metadata, events, audio, PTZ, I/O, and other device functions. | Consult the device manufacturer’s documentation. |
Local | 8966/TCP | Failover Recording Server Manager tray process | Failover Recording Server | Local only. No cross-host firewall rule is required. | Provides local Failover Recording Server service status and service management. | |
Local | 8967/TCP | Failover Server Manager tray process | Failover Server service | Local only. No cross-host firewall rule is required. | Provides local Failover Server service status and service management. | |
Local | 11000/TCP | Failover Server service | Failover Recording Server failover-response service | Local only. No cross-host firewall rule is required. | Supports health polling and failover-control messages between the local Failover Server service and Failover Recording Server service. |
Event server communicates with XProtect clients, API Gateway, supported integrations, management server, SQL Server, optional XProtect LPR Server, and optional Milestone Customer Dashboard services.
Generic Events and Analytics Events connections are required only when the corresponding inputs are enabled and configured.
Direction | Port / transport | Peer component or system | Peer service | Firewall use | Purpose | Details |
|---|---|---|---|---|---|---|
Inbound | 1234/TCP and/or UDP, configurable | External Generic Events senders | Compatible Generic Events listener | Disabled by default. Allow only from configured Generic Events sources. | Receives Compatible Generic Events from external systems or devices. | |
Inbound | 1235/TCP, configurable | External Generic Events senders | International Generic Events listener | Disabled by default. Allow only from configured Generic Events sources. | Receives International Generic Events from external systems or devices. | |
Inbound | 9090/TCP, configurable | External Analytics Events senders | Analytics Events listener | Disabled by default. Allow only from configured Analytics Events sources. | Receives Analytics Events. | |
Inbound | 22331/TCP | XProtect clients and integrations | Event Server WCF services | Allow from clients and integrations that require Event Server services. | Provides configuration, alarms, maps, status, actions, and related services. | |
Inbound | 22332/TCP | API Gateway, Management Client , and supported direct API clients | Event Server REST and WebSocket services | Allow from API Gateway and supported API clients. | Provides events, alarms, subscriptions, and WebSocket messaging APIs. | |
Inbound | 22333/TCP | MIP plug-ins and applications | Legacy MIP message service | Used only without event server certificate encryption. | Provides legacy MIP messaging. | |
Outbound | 80 or 443/TCP, configured management server URI | Management server computer | Management Server web services and Identity Provider | Allow to the configured management server URI. | Supports configuration, service discovery, state, authentication-related discovery, and registration. | |
Outbound | 443/TCP |
| Milestone Customer Dashboard HTTPS service | Allow when Milestone Customer Dashboard communication is enabled and licensed. | Sends Milestone Customer Dashboard key, notification, status, error, and heartbeat information. | — |
Outbound | Configured SQL endpoint/TCP, conventionally 1433 | Configured SQL Server | SQL Server | Allow to the SQL endpoint specified in the connection configuration. | Stores and retrieves event server event, alarm, and configuration data. | — |
Outbound | 22334/TCP, configurable | LPR Server computer | LPR Server WCF service | Allow when XProtect LPR and the event server LPR plug-in are installed. | Retrieves recognized plates and status and sends supported LPR commands and configuration requests. |
API Gateway can be installed on the management server computer or on a separate computer. A deployment can contain multiple API Gateway instances.
Only the API Gateway installed on the management server computer provides log submission and retrieval. The local OpenTelemetry Collector and VictoriaLogs entries in this table apply only to that API Gateway.
Direction | Port / transport | Peer component or system | Peer service | Firewall use | Purpose | Details |
|---|---|---|---|---|---|---|
Inbound | Configured IIS HTTP port/TCP, normally 80 | API clients, XProtect clients, XProtect server components, and integrations | API Gateway through IIS | Allow from systems that require HTTP access to API Gateway. | Provides Gateway REST, WebSocket, WebRTC, Management proxy, and Event proxy services. The API Gateway installed on the management server computer also provides log submission and retrieval. | |
Inbound | Configured IIS HTTPS port/TCP, normally 443 | API clients, XProtect clients, XProtect server components, and integrations | API Gateway through IIS | Allow from systems that require HTTPS access to API Gateway. | Provides transport-secured Gateway REST, WebSocket, WebRTC, Management proxy, and Event proxy services. The API Gateway installed on the management server computer also provides log submission and retrieval. | |
Outbound | Configured management server URI/TCP, normally 80 or 443 | Management server computer | Management Server web services and Identity Provider | Allow to the configured management server URI. | Supports Management REST, discovery, Identity Provider, registration, permissions, and related proxied requests. | |
Outbound | 22332/TCP | Event server computer | Event Server REST and WebSocket services | Allow to each event server used by API Gateway. | Proxies events, alarms, subscriptions, and WebSocket messaging requests. | |
Local | 4318/TCP | OpenTelemetry Collector on the management server computer | OpenTelemetry Collector | Internal on the management server computer. Do not allow cross-host access through the firewall. | Sends API Gateway logs to the OpenTelemetry Collector using OTLP/HTTP. | |
Local | 9428/TCP | VictoriaLogs on the management server computer | VictoriaLogs system-log service | Internal on the management server computer. Do not allow cross-host access through the firewall. | Queries system logs. | |
Local | 9429/TCP | VictoriaLogs on the management server computer | VictoriaLogs audit-log service | Internal on the management server computer. Do not allow cross-host access through the firewall. | Queries audit logs. | |
Local | 9430/TCP | VictoriaLogs on the management server computer | VictoriaLogs rule-log service | Internal on the management server computer. Do not allow cross-host access through the firewall. | Queries rule logs. |
Data Collector accepts System Monitor requests from the management server and independently connects to the configured Management Server web-service endpoint to register and submit monitoring information.
Direction | Port / transport | Peer component or system | Peer service | Firewall use | Purpose | Details |
|---|---|---|---|---|---|---|
Inbound | 7609/TCP | Management server computer | Data Collector | Allow from the management server computer. | Provides live performance counters and monitoring information for System Monitor. | |
Outbound | Configured management server URI/TCP, normally 80 or 443 | Management server computer | Management Server web services | Allow to the configured management server URI. | Supports service registration, machine properties, monitoring-data batches, state changes, and related management server communication. |
Mobile Server acts as the system gateway for XProtect Mobile client and XProtect Web Client. It retrieves media from recording servers and communicates with optional Milestone-hosted services when the corresponding functions are enabled.
The administrator configures whether the Mobile Server HTTP listener, HTTPS listener, or both listeners are available.
Direction | Port / transport | Peer component or system | Peer service | Firewall use | Purpose | Details |
|---|---|---|---|---|---|---|
Inbound | 8081/TCP, configurable | XProtect Mobile client, XProtect Web Client, Management Client | Mobile Server HTTP service | Allow from clients that use the unsecured Mobile Server interface. | Provides client commands and video and audio delivery. | |
Inbound | 8082/TCP, configurable | XProtect Mobile client, XProtect Web Client, Management Client | Mobile Server HTTPS service | Allow from clients that use the secured Mobile Server interface. | Provides transport-secured client commands and video and audio delivery. | |
Inbound | 40001 + channel index/TCP, configurable | Recording server computer | Mobile Server Video Push media-provider listener | Disabled by default. Allow from applicable recording server computers when Video Push is enabled. | Provides the recording server with access to a Video Push virtual-camera feed. | |
Outbound | 443/TCP |
| Milestone address-book or Smart Connect service | Allow when the address-book or Smart Connect function is enabled. | Provides address-book or Smart Connect communication. | — |
Outbound | 443/TCP |
| Milestone push-notification service | Allow when mobile push notifications are enabled. | Sends mobile push-notification requests. | — |
Outbound | Configured management server URI/TCP, normally 80 or 443 | Management server computer | Management Server web services and Identity Provider | Allow to the configured management server URI. | Supports authentication, configuration, service registration, and discovery of registered service endpoints. | |
Outbound | Configured recording server URI/TCP, commonly 7563 | Active Management server computer | Recording Server media and command services | Allow to the registered recording server addresses returned by the management server. | Retrieves video and audio and performs supported device and media operations. | |
Local | Not applicable | Mobile Server Manager tray process | Mobile Server service | Uses a named pipe. No TCP firewall rule is required. | Provides local Mobile Server status and service management. |
XProtect LPR Server communicates with the management server and recording server and accepts requests from the event server LPR plug-in and supported administration clients.
Include these connections only when XProtect LPR is installed.
Direction | Port / transport | Peer component or system | Peer service | Firewall use | Purpose | Details |
|---|---|---|---|---|---|---|
Inbound | 22334/TCP, configurable | Event server LPR plug-in, supported administration clients, and the local LPR Server Manager tray icon | LPR Server WCF service | Allow from the event server computer and supported administration computers when XProtect LPR is installed. | Provides LPR Server status, recognized-license-plate results, commands, configuration, and JPEG-analysis requests. | |
Outbound | Configured management server URI/TCP, normally 80 or 443 | Management server computer | Management Server web services and Identity Provider | Allow to the configured management server URI. | Supports authentication, configuration, service registration, and discovery of recording server addresses. | |
Outbound | Configured recording server URI/TCP, commonly 7563 | Active recording server computer | Recording Server media and command services | Allow to the configured recording server URI. | Retrieves video for license-plate recognition processing. |
XProtect Smart Client initiates connections to the management server, API Gateway, recording server, and event server according to the features used by the client.
When configured as a Matrix recipient, the XProtect Smart Client computer also accepts inbound Matrix commands from the management server. Milestone Map Service requires outbound HTTPS access when enabled for Smart Maps.
Direction | Port / transport | Peer component or system | Peer service | Firewall use | Purpose | Details |
|---|---|---|---|---|---|---|
Inbound | 12345/TCP by default, configurable | Management server computer | XProtect Smart Client Matrix recipient | Disabled by default. Allow from the management server computer when the XProtect Smart Client computer is configured as a Matrix recipient. | Receives Matrix connect, disconnect, and view commands. | |
Outbound | Configured HTTP or HTTPS port/TCP, normally 80 or 443 | Management server computer, API Gateway computer | Management Server web services, Identity Provider, and API Gateway | Allow to the configured management server and API Gateway addresses. | Supports authentication, service discovery, configuration, management server APIs, optional XProtect Incident Manager functionality, and API Gateway services. | Management server computer listeners / API Gateway computer listeners |
Outbound | 443/TCP |
| Milestone Map Service | Allow when Milestone Map Service is enabled and used for Smart Maps. | Retrieves geographic map data for Smart Maps. | — |
Outbound | Configured recording server URI/TCP, commonly 7563 | Active recording server computer | Recording Server media and command services | Allow to the recording server addresses returned by the system. | Retrieves live and recorded video, audio, and metadata and performs supported PTZ and other media operations. | |
Outbound | 22331/TCP | Event server computer | Event Server WCF services | Allow to the configured event server. | Provides access to alarms, maps, configuration, status, actions, and related Event Server services. | |
Outbound | 22332/TCP | Event server computer | Event Server REST and WebSocket services | Allow when the XProtect Smart Client uses event server REST or WebSocket interfaces directly. | Provides event and state subscriptions, events, alarms, and WebSocket messaging. |
Management Client connects to the management server, API Gateway, recording server, event server, and Mobile Server to perform supported configuration and administration functions.
The exact connections required depend on the components and features administered from the client.
Direction | Port / transport | Peer component or system | Peer service | Firewall use | Purpose | Details |
|---|---|---|---|---|---|---|
Outbound | Configured HTTP or HTTPS port/TCP, normally 80 or 443 | Management server computer, API Gateway computer | Management Server web services, Identity Provider, and API Gateway | Allow to the configured management server and API Gateway addresses. | Supports authentication, service discovery, configuration, management server APIs, optional XProtect Incident Manager functionality, and API Gateway services. | Management server computer listeners / API Gateway computer listeners |
Outbound | 7563/TCP, or configured recording server URI | Active recording server computer | Recording Server media and command services | Allow to the recording server addresses returned by the system. | Retrieves video, audio, metadata, JPEG images, status information, and supported device data used during administration. | |
Outbound | 8081/TCP, configurable | Mobile Server computer | Mobile Server HTTP service | Allow when Mobile Server administration uses the HTTP listener. | Supports applicable Mobile Server administration functions. | |
Outbound | 8082/TCP, configurable | Mobile Server computer | Mobile Server HTTPS service | Allow when Mobile Server administration uses the HTTPS listener. | Supports applicable Mobile Server administration functions. | |
Outbound | 22331/TCP | Event server computer | Event Server WCF services | Allow to the configured event server. | Provides access to event server configuration, alarms, maps, status, actions, and related services. | |
Outbound | 22332/TCP | Event server computer | Event Server REST and WebSocket services | Allow when the Management Client uses event server REST or WebSocket interfaces. | Provides event and state subscriptions, events, alarms, and WebSocket messaging. |
XProtect Mobile client connects to the Mobile Server by using the configured HTTP or HTTPS listener. The client does not connect directly to the recording server.
Direction | Port / transport | Peer component or system | Peer service | Firewall use | Purpose | Details |
|---|---|---|---|---|---|---|
Outbound | 8081/TCP, configurable | Mobile Server computer | Mobile Server HTTP service | Allow when the Mobile Server unsecured listener is enabled and used. | Supports login, client commands, and video and audio delivery. | |
Outbound | 8082/TCP, configurable | Mobile Server computer | Mobile Server HTTPS service | Allow when the Mobile Server secured listener is used. | Supports transport-secured login, client commands, and video and audio delivery. |
XProtect Web Client connects to the Mobile Server by using the configured HTTP or HTTPS listener. The browser does not connect directly to the recording server.
Direction | Port / transport | Peer component or system | Peer service | Firewall use | Purpose | Details |
|---|---|---|---|---|---|---|
Outbound | 8081/TCP, configurable | Mobile Server computer | Mobile Server HTTP service | Allow when the Mobile Server unsecured listener is enabled and used. | Supports login, client commands, and video and audio delivery. | |
Outbound | 8082/TCP, configurable | Mobile Server computer | Mobile Server HTTPS service | Allow when the Mobile Server secured listener is used. | Supports transport-secured login, client commands, and video and audio delivery. |
Milestone Open Network Bridge authenticates through the Management Server and retrieves requested live and recorded media from the Recording Server .
ONVIF or RTSP clients initiate control connections to the bridge. If UDP media transport is negotiated, the bridge initiates RTP and RTCP traffic to the client-selected UDP ports.
Direction | Port / transport | Peer component or system | Peer service | Firewall use | Purpose | Details |
|---|---|---|---|---|---|---|
Inbound | 554/TCP, configurable | ONVIF and RTSP clients | Milestone Open Network Bridge RTSP service | Allow from ONVIF or RTSP clients that retrieve media through the bridge. | Provides RTSP session control and optionally carries interleaved RTP and RTCP media. | |
Inbound | 580/TCP, configurable | ONVIF clients | Milestone Open Network Bridge ONVIF service | Allow from ONVIF clients that require bridge access. | Provides ONVIF authentication, control, configuration, PTZ, events, searches, and stream-URI requests. | |
Inbound | 3702/UDP | WS-Discovery clients | Milestone Open Network Bridge discovery service | Optional and disabled by default. Allow when WS-Discovery is enabled. | Enables ONVIF discovery. | |
Outbound | Configured Management Server URI/TCP, normally 80 or 443 | Management server computer | Management Server web services and Identity Provider | Allow to the configured Management Server URI. | Supports authentication, service registration, configuration, and service discovery. | |
Outbound | Configured Recording Server URI/TCP, commonly 7563 | Active recording server computer | Recording Server media and command services | Allow to the recording server addresses registered for the site. | Retrieves live and recorded video and supported audio for ONVIF or RTSP clients. | |
Outbound | Negotiated UDP port pairs | ONVIF or RTSP client | Client RTP and RTCP receivers | Allow when UDP media transport is negotiated. | Sends video and supported audio to the requesting client. | — |
Firewall configuration considerations
Configure firewall access according to the installed components and enabled features in the deployment:
Allow inbound access only to listeners that are required.
Restrict source addresses to the computers, clients, integrations, or external systems that require access.
Do not expose local or same-computer service ports to other computers.
For configurable ports and destinations, use the values defined in the deployment configuration.
For third-party hardware devices, allow only the ports and protocols required by the device and consult the device manufacturer’s documentation.
Outbound connections are commonly permitted by default in Windows Firewall, but network firewalls and organizational security policies can require explicit outbound rules.