Ports and firewalls¶
Enclave is designed to work behind closed firewalls. Systems running Enclave initiate all connections outbound, so there are no inbound ports to open, no static IP addresses to allowlist, and no listening services exposed to the internet.
No inbound ports¶
Unlike traditional VPNs, Enclave does not require any open inbound firewall ports. NAT traversal techniques such as UDP and TCP hole punching allow peers to establish direct, peer-to-peer connectivity without either side needing to accept inbound connections. See NAT traversal and connectivity for details on how these connections are established.
Every open inbound port is a listening service visible to the internet - a target for scanning, brute-force attacks, and exploitation. No inbound ports means no externally visible attack surface. It also removes the operational burden of coordinating firewall changes, static IP addresses, and port-forwarding rules at every customer site - deployments that would otherwise require site visits or change requests can be done remotely.
Outbound requirements¶
Enclave needs outbound access to the Enclave platform on TCP 443 and outbound UDP access for peer-to-peer connectivity. For the full list of hostnames and protocols your firewall should allow, see the KB article on firewall ports and requirements.
SSL/TLS inspection¶
Enclave communicates with the Enclave platform over TCP 443 using an optimised protocol - not standard HTTPS. Firewalls or proxies that perform deep packet inspection on this traffic will break connectivity. If your network uses SSL/TLS inspection, you will need to add Enclave platform domains to a skiplist or configure transparent mode. See the firewall integration guidance for vendor-specific workarounds.
Working with restrictive networks¶
In environments where outbound access is heavily restricted, Enclave can force all traffic through relay servers with known, fixed IP addresses. This constrains egress to a pre-authorised list that you can add to your firewall rules. See the traffic relays section for details.
Last updated August 1, 2026