Which firewall settings do I need to consider?

Last updated: 15/04/2025

Controlling firewall settings is essential to ensure that the Gateway can reliably communicate with cloud services for real-time data, updates, and remote monitoring. Without proper configuration, firewalls can block necessary outbound connections, causing disruptions or limited functionality.

Production

The production cluster uses the following addresses:

Note: All traffic from our servers will appear from IP 51.107.187.140.

Gateway

The Gateway must be able to contact several external services, such as Tailscale, NTP, Docker, GitLab, and FLEXeCHARGE services.

Please allow outbound connections using the protocols and ports listed below.

OpenVPN

Tailscale

Based on the official Tailscale documentation: 
Tailscale firewall ports

Recommended Tailscale firewall rules

• TCP 443 - allow outbound connections to *:443
• UDP 41641 - allow outbound WireGuard traffic from port 41641 to *:*
• UDP 3478 - allow outbound STUN traffic to *:3478

If these rules are too open for your firewall policy, allowlist the specific Tailscale services below.

Required Tailscale hostnames

DERP relay servers

For DERP servers, please use the official Tailscale DERP list as the source of truth: 
https://login.tailscale.com/derpmap/default

Expand the regions below to see the corresponding Tailscale DERP relay servers that may need to be allowlisted in your firewall.

For installations located in Europe, it is usually sufficient to allowlist the European DERP regions only.

European DERP regions

Rest of the world

NTP

DNS

FLEXECHARGE services

Summary