What firewall rules does the connector need?
One outbound rule to the internet and one outbound rule on the LAN. Offline authentication adds one rule each way. The connector opens every connection to the internet itself, so it works behind NAT and CGNAT.
Passbeam
connector.passbeam.co.uk
Outbound TCP 443
The only connection leaving your network, plus UDP 1812 to Passbeam if offline authentication is on. Nothing inbound from the internet, ever.
Connector
A container on the customer's own network, run with --network host
Outbound UDP 3799
Disconnect and CoA, to private addresses only. The reply comes back on the same flow, so no inbound rule is needed.
Access point, switch or VPN gateway
Must have disconnect requests enabled, and the connector's address in its RADIUS profile
The reply to a disconnect comes back on the connection the connector opened, so a stateful firewall doesn't need a rule for it. Limit the LAN rule to your network equipment, not the whole subnet. The connector already refuses anything else: it only sends to private addresses, on those two ports, with RADIUS codes 40 and 43. A firewall rule means you don't have to rely on our code for that.
| Direction | Protocol | Port | Other end | What for |
|---|---|---|---|---|
| Outbound, to the internet | TCP | 443 | connector.passbeam.co.uk | Enrolment, waiting for work and reporting results |
| Outbound, to the internet | UDP | 1812 | Passbeam's two RADIUS servers | Offline authentication only. Passes your switches' requests on to Passbeam |
| Outbound, to the internet | UDP/TCP | 53 | Your own resolver | To look up that name. Not needed if the firewall does the lookup for it |
| Outbound, on the LAN | UDP | 3799 | Your access points, switches and gateways | RFC 5176 Disconnect and CoA. This is what the connector is for |
| Outbound, on the LAN | UDP | 1700 | Your access points, switches and gateways | The same, for equipment that uses Cisco's older port. Leave out if none of yours do |
| Inbound, from the LAN | UDP | 1812 | Your switches | Offline authentication or the RADIUS proxy. Both ship switched off. Not needed for disconnect |
| Inbound, from the LAN | UDP | 1813 | Your equipment | RADIUS proxy only, and it ships switched off. Not needed for disconnect |
| Inbound, from the internet | — | None | — | No rule needed. Don't add one |
`connector.passbeam.co.uk` is served through Cloudflare, so it has no fixed IP address. Write the rule using the name if your firewall supports it, or allow Cloudflare's published ranges. If neither works for you, let us know.
The 1812 rows are only for offline authentication, which is off by default. Your switches send to the connector on UDP 1812, and the connector passes those requests on to Passbeam's two RADIUS servers, the addresses on the site's Connect tab. UDP 1813 inbound is for the RADIUS proxy. On a normal install the connector listens on nothing.
One more thing: the clock has to be roughly right, within a few minutes, or TLS checks fail. Any normal time sync is fine.
Related questions
- RADIUS or RADSec: which should I use?
- Is standard RADIUS safe enough to use?
- What address and port do I point my equipment at?
- How do I set up Cisco Meraki with Passbeam?
- A printer keeps failing with a TLS error. Why would I let a site accept older TLS?
- A camera or printer is still refused after I allowed older TLS. What now?
- Can Passbeam authenticate our VPN as well as the network?
- Our VPN concentrator serves several clients from one address. Will Passbeam tell them apart?
- Can I let only some people use the VPN, but everyone use the office network?
- Can I require a second factor on the VPN?
- Do you support PEAP, MSCHAPv2 or EAP-TTLS?
- Do you support RADIUS accounting?
- How do I disconnect a device that is already connected?
Still stuck? Ask us, or read the rest of the knowledge base.