What firewall rules does the connector need?

One outbound rule to the internet, and one outbound rule on the LAN. Nothing inbound, from anywhere. The connector opens every connection it takes part in, which is what lets it work behind NAT and CGNAT.

The reply to a disconnect returns on the flow the connector opened, so a stateful firewall needs no rule for it. Scope the LAN rule to your network equipment rather than to the whole subnet. The connector refuses anything else itself — private addresses only, those two ports only, and only RADIUS codes 40 and 43 — but a rule that says the same thing does not depend on trusting our code.

`connector.passbeam.co.uk` is served through Cloudflare, so it has no stable IP address and we will not pretend otherwise. Write the rule against the name if your firewall supports it, or allow Cloudflare's published ranges — wider than ideal, and we would rather say so. If neither works for you, tell us: Passbeam already publishes its RADIUS listeners on fixed addresses, so an endpoint on one is something we know how to do.

The two inbound rows are for the RADIUS proxy, which ships switched off. That is the other half of the connector — your equipment pointing authentication and accounting at it, and the connector forwarding them to Passbeam over the connection it already holds. On a default install it listens on nothing at all, so skip those rows unless you have deliberately turned it on.

One requirement that is not a firewall rule: the clock has to be roughly right, within a few minutes, or TLS validation fails. Any normal time sync will do.