Knowledge base
Knowledge base
Breadcrumbs

On-Premise Scanning network and firewall requirements

Learn what networking requirements there are on On-Premise Scanning, including firewalls

Last updated: 2026-11-02


Introduction

On-Premise Scanning is built using an open box strategy, leading to this document being split into two

  • Requirements for Outpost24 software

  • Guidance on Debian requirements

Outpost24 Software

On-Premise Scanning as a general rule does NOT need to “connect out“ during normal operation. During updates however, a range of addresses are accessed for different update procedures. Inbound rules are generally used during normal operation, especially for RC Scanners to operate together with On-Premise Scanning.

Inbound Rules

Service

Port / Protocol

Description

RC Scanner sync

443 / TCP

RC Scanners call home to this port, including uploading of scan data (S3)

Outbound Rules

Service

Destination

Port / Protocol

Description

GitHub

github.com

443 / TCP

Downloading k3s/argocd CLI binaries

SyncHub

synchub.prod.outpost24.com

443 / TCP

Communication with SyncHub

containerd

registry.outpost24.com

443 / TCP

Image pulls via internal mirror

ArgoCD

gitlab.com

443 / TCP

GitOps repository sync

CoreDNS

Per-node /etc/resolv.conf

53 / TCP+UDP

External DNS resolution for pods

NTP client

Per-node NTP configuration

123 / UDP

Time sync for TLS certs

Debian Requirements

The user is responsible for keeping the Debian system that On-Premise Scanning relies on up to date. If the machine needs to be firewall to prevent external access, updates may not go through. In order to successfully update a Debian system in a firewalled environment, you either need to use the offline update methodology, or open up network access to the sources listed in /etc/apt/sources.list.