Allowlist requirements for IP addresses and URLs

To allow seamless connectivity to the Datto RMM Web Portal, and between Agents, you must open TCP port 443 outbound through your firewall.

If your company has a more aggressive security posture for outbound traffic (e.g. port blocking and IP address access lists), then you may need to add a number of IP addresses to the allowlist, as well as open up port 443 to allow Datto RMM to make the required connections. The IP addresses you must add to the allowlist are specific to your platform, and you only need to add those associated with your platform.

NOTE  For information about the platform your site is hosted on, refer to Datto RMM platforms.

For partners managing devices in environments with rigorous network security, note that the following ports are used by Datto RMM's extended processes, remote tools, and software management. These ports are actively used by the Agent all of the time.

• Port 13229 (TCP) - used for Agent to Agent communication.
• Port 13300 (UDP) - used for Agent discovery.
• Port 6800 (TCP) - used for Agent communication with the Aria process.

The initial connection between browser and Agent is initialized via WebRTC servers. Refer to WebRTC. Depending on the firewall configuration, the connection will resolve via STUN server (when P2P connection is possible) or TURN server (when Relay connection would be chosen). The WebRTC servers are located in several regions. Refer to Add the following IP addresses and URLS to the allowlist.

The minimum requirements for Web Remote are as follows: outbound port 3478 and ports between 49152 - 65535 should be open (both TCP and UDP) for the IPs listed under IP addresses for the tunnel server grid. In addition, make sure to add the following URL to the allowlist:

Unless a peer-to-peer connection can be established between devices, Agent to Agent connectivity and remote takeover are managed by a tunnel server over an encrypted connection. Tunnel servers are connection relays located around the globe to provide maximum coverage and the best performance depending on your location. They are automatically available to all users.

When a remote takeover session is initiated:

1. The admin device performs a DNS query to find the nearest tunnel server. The tunnel server is picked based on the proximity to the admin device.

2. A connection is made to a load-balanced tunnel server cluster.

3. Finally, a connection is established to the remote device.

To make the most of the tunnel server grid, please ensure that the IP addresses relevant to your geographic location are added to the allowlist and outbound traffic on port 443 is open on your own and your endpoints' firewalls.

The following rules are configured for all local and remote ports:

Rule Name	Protocol	Description	Inbound	Outbound
AEMAgent	ANY	Datto RMM Agent Process
aria2c	ANY	Download manager used by the AEMAgent process
CentraStage_monitor	TCP/UDP	Datto RMM Monitoring Agent
CentraStage_service	TCP/UDP	Datto RMM Agent Service
RMM RTC Proxy	ANY	Datto RMM Web Remote RTC Proxy Service
RMM RTO Proxy	ANY	Datto RMM Web Remote RTO Proxy Service
RMM Web Remote	ANY	Datto RMM Web Remote Process
uVNC_Service	TCP/UDP	uVNC Service for VNC Connections

The Datto RMM Agent communicates with the platform using the IPv4 protocol.

NOTE  IPv6 connections are not supported at this time.

It is strongly recommended that any Stateful Packet Inspection be turned off for access to any centrastage.net address, and that all attempts possible are made to guarantee that TCP connections to the cc.centrastage.net addresses are not terminated in cases of inactivity. (These connections may be inactive for up to 180 seconds at a time if no client activity is detected.)

In addition to IP addresses, some firewalls, proxies or security appliances may require access to the URL of the service as well as the IP address.

If you are using a proxy or security appliance, we recommend that you add the centrastage.net and the rmm.datto.com domains to the allowlist in their entirety if possible, or at a minimum, ensure that the relevant URLs to your platform are added to the allowlist.

ComStore component and Software Management URLs

If you are downloading and running components from the ComStore, we recommend that you add storage.centrastage.net and storage.rmm.datto.com to the allowlist. Additionally, if you use any of the software applications below either as a ComStore component or via Software Management, make sure to add the relevant URL(s) to the allowlist:

In addition, storage.centrastage.net should be added to the allowlist as it uses the following:

• Windows 10: Deploy via ISO component: Windows 10 ISOs
• Health check tool: 7-zip, WMI check and version check binaries
• Temperature monitor component: temperature checker binary
• Intel EMA integration: EMA deployment component
• Datto workplace opportunity audit tool: logfile condenser tool
• Required for crypto-ransomware device isolation