Firewall and allowlist quick reference

The hosts and ports to allow for AO, on one page. Start with the core rules for the AO you use, then add the optional ones for the features your users need. For details, live updates and troubleshooting, see Network and firewall requirements.

Which rules do you need?

If you use…	Allow…
AO in the cloud	Outbound `443/TCP` from users' browsers to `ao.terradepth.com`, exempt from TLS inspection. Add Microsoft or Google sign-in only if you use it. See AO in the cloud and AO for government, below.
AO for government	The same rules, with `gov.terradepth.com` in place of `ao.terradepth.com`. See AO in the cloud and AO for government, below.
Self-hosted AO	Inbound `8888/TCP` to your AO server from the computers that use AO, or only from your TLS proxy if you put one in front of AO; `443/TCP` once HTTPS is set up on the server. Block other inbound ports on a firewall in front of the server, or in Docker's `DOCKER-USER` chain: ufw or firewalld rules on the server don't block the ports Docker publishes. The server needs no outbound access to run. See Self-hosted AO and AO OnBoard, below, then Optional: outbound from your AO server for features such as email.
AO OnBoard	The self-hosted rules, plus inbound `3389/TCP` if people use the processing workstation by remote desktop. See Self-hosted AO and AO OnBoard, below.
Air-gapped (self-hosted AO or AO OnBoard)	Only rules inside your network: the inbound rules in Self-hosted AO and AO OnBoard, and outbound rules from your AO server to servers on your network, such as your mail server. Block everything outside your network: an air-gapped build doesn't need it. This is set when your AO system is built: see Air-gapped networks in Network and firewall requirements.
Something stopped working	AO doesn't load: check the rule for your AO in this table. Microsoft or Google sign-in fails: allow its sign-in host, in your AO's section below. The map has no basemap or terrain: see Optional: online map layers and services. For more, see Troubleshooting in Network and firewall requirements, or Troubleshooting and getting help.

AO in the cloud and AO for government

Allow outbound from users' browsers. AO for government uses the same rules, with gov.terradepth.com in place of ao.terradepth.com.

Allow	Port	Needed
`ao.terradepth.com` for AO in the cloud, or `gov.terradepth.com` for AO for government	`443/TCP`	Always. Exempt it from TLS inspection and browser isolation
`login.microsoftonline.com` (Microsoft) or `accounts.google.com` (Google)	`443/TCP`	Only if your organization signs in with Microsoft or Google

Make sure your mail gateway accepts AO's invitation and password reset emails. To get the sending address, contact support@terradepth.com.

Self-hosted AO and AO OnBoard

Allow inbound to the AO server from the computers that use AO:

Port	For	Needed
`8888/TCP`	AO in a browser over HTTP, or from your own TLS proxy	Unless everyone uses HTTPS on port 443 (HTTP stays on, with no redirect). With a proxy, allow it only from the proxy
`443/TCP`	AO in a browser over HTTPS	Once HTTPS is set up on the AO server
`80/TCP` from the internet	Let's Encrypt certificates	Only with Let's Encrypt, when a certificate is issued and at each renewal
`3389/TCP`	Remote desktop to the processing workstation	AO OnBoard only

AO's internal services also listen on the server, on every network interface. Docker publishes their ports itself, so ufw or firewalld rules on the server don't block them. From other computers, allow only these ports, plus your own administration access such as SSH. Block all other inbound ports on a firewall in front of the server or, with Docker, in Docker's DOCKER-USER chain, then check with a port scan from another computer. The AO server needs no outbound access to run. With single sign-on, users' browsers also reach your identity provider, as in the section above. On an air-gapped network, allow nothing outside your network.

Optional: online map layers and services

Allow outbound 443/TCP from users' browsers. A normal allow is enough: these hosts don't need a TLS inspection exemption. If one is blocked, AO still works, without the feature listed.

Host	For
`api.cesium.com`, `assets.ion.cesium.com`	Global terrain and imagery
`*.virtualearth.net`	The Aerial, Aerial+Labels and Roads+Labels basemaps
`www.google.com` (only `www.google.com/generate_204`)	AO's internet check. If it's blocked, AO acts as if it's offline
`help.terradepth.com`	The Help Center link in AO
`gis.charttools.noaa.gov`, `nowcoast.noaa.gov`, `gibs.earthdata.nasa.gov`, `tile.openstreetmap.org`, `mapproxy.osm.ch`	Built-in map layers, off until a user turns them on
Each external layer's host	External layers your organization adds

Optional: outbound from your AO server

Self-hosted AO and AO OnBoard only. Allow each one only for a feature you use:

Feature	Allow outbound to
Email	Your mail server, `465/TCP` or `587/TCP`
Single sign-on	`443/TCP` to `login.microsoftonline.com` and `graph.microsoft.com` (Microsoft), `oauth2.googleapis.com` and `openidconnect.googleapis.com` (Google), or your own identity provider
Cloud mounts	Your storage: `443/TCP` for S3, Google Cloud Storage, Azure or Google Drive; `22/TCP` for SFTP; `445/TCP` for SMB; `21/TCP` and the server's passive ports for FTP; the other AO's address for a mount to another AO
Remote Sync	The other AO's address, such as `443/TCP` for AO in the cloud
External layers	Each layer's host. AO checks a layer from the server when someone adds it, and while an animated layer is on
HTTPS certificates	Let's Encrypt: `443/TCP` to `acme-v02.api.letsencrypt.org`. Tailscale: Tailscale's own connections (see Optional: remote support)

Optional: remote support (only if your agreement includes it)

Some AO OnBoard and self-hosted systems are set up so Terradepth support can reach them. This is arranged for each system, as your agreement describes. AO works without it, and air-gapped systems don't use it. If your agreement doesn't include remote support, skip this section.

Method	Rule	Used for
SSH	Inbound `22/TCP`, plus `2222/TCP` on AO OnBoard	Command-line access to the server
Tailscale	Outbound `41641/UDP`, and `443/TCP` as a fallback	Remote desktop and SSH
Cloudflare Tunnel	Outbound `7844/TCP` and `7844/UDP`	HTTPS access to AO

Tailscale and Cloudflare Tunnel connect out from your system, so they need no inbound rules. To ask what's set up on your system, contact support@terradepth.com.