Ports and firewall rules

The short version

• Everything uses HTTPS on port 443. The web interface, collectors reporting in, customer collectors connecting to an MSP master collector, and each collector's management page. No odd port numbers in addresses: https://uplivra.yourcompany.com/.
• Collectors only connect out. A collector reaches your Uplivra server (or your MSP's master collector) on TCP 443. Nothing needs to connect in to a collector for it to work; incoming ports on a collector are only for its management page and for devices sending it SNMP traps, logs or traffic flows.
• SSH is optional. Incoming SSH to an Uplivra computer is only needed when you manage its Linux system over SSH, when you invite Uplivra support for a session, or on an MSP master collector that other collectors reach over SSH instead of HTTPS (not in router mode, see below; TCP 22, or 2222 when the computer's own SSH has 22).
• Remote support sessions (SSH, Remote Desktop and web apps through a collector) need no new ports. They travel inside the collector's HTTPS connection; the collector then connects to the device on the port allowed (22, 3389, 80 or 443 by default). See Remote access.
• SNMP traps come in on UDP 162 when you turn them on for a site. See SNMP traps.

To see the rules for a computer that's already installed, run this on it:

uplivra ports

It reads that computer's settings and prints what it needs, incoming and outgoing. uplivra ports -all prints every kind of computer, the same tables as below.

Changing the ports

You can choose different ports during installation, or change them later.

When the server's port changes, it keeps answering on the old one for a while and tells every collector the new port. Collectors check that the new port answers with the same certificate, switch by themselves, and remember it. Settings › Ports and firewall lists anything still using the old port; close it there once that list is empty.

Ports 514, 2055, 4739, 6343 and 9995 are kept for logs and traffic flows, so they can't be chosen for a web page.

MSP master collectors: HTTPS or SSH

Customer collectors connect to a master collector in one of two ways. Both carry the same encrypted HTTPS connection, checked against the master's certificate, and each customer collector still signs in with its own key.

• HTTPS (normal): TCP 443 from the customer network to the master. It shares the port with the master's management page; Uplivra tells them apart.
• SSH: for customer networks that allow SSH out but not HTTPS. The master listens on TCP 22, or 2222 when its own Linux SSH already uses 22. SSH here is only a carrier: there's no shell, no commands and no forwarding anywhere else.

SSH between collectors uses keys only, never passwords:

• Each collector makes its own SSH key the first time it connects. The key is stored encrypted, in a folder only the collector's service account can open (/var/lib/uplivra-collector/ssh, mode 700). The key's passphrase is protected like the credential vault's key: a private file on Linux, and Windows' own data protection on Windows.
• A master only lets in keys the Uplivra server knows. The first time, the collector proves who it is with its setup code (or, if it's already connected, its collector key). The master checks that with the server, which then adds the key to the list it sends every master.
• Removing a collector in Uplivra removes its key. Masters drop its SSH connection within a minute.
• The master's own host key is kept the same way. Collectors check it against the host key you give them, so they can't be pointed at an impostor.

Router mode doesn't use SSH: there, customer collectors reach the master through the GRE/IPsec tunnels, over HTTPS.

To set up SSH, choose it on the master during install, or add ssh_listen to its /etc/uplivra/collector.json and restart it:

"relay": { "listen": ":443", "ssh_listen": ":2222" }

The master's page in Uplivra (Settings › Sites and collectors) then shows its SSH host key next to its certificate fingerprint. On the customer collector, choose "SSH, through my MSP's master collector" during install, or add these to its collector.json:

"server_url": "https://master.yourmsp.com",
"server_fingerprint": "the master's certificate fingerprint",
"server_ssh": "master.yourmsp.com:2222",
"server_ssh_host_key": "SHA256:the master's SSH host key"

Customer collectors can also list a second master as a fallback, over HTTPS or SSH:

"fallback_servers": [
  { "url": "https://master2.yourmsp.com", "fingerprint": "...",
    "ssh": "master2.yourmsp.com:2222", "ssh_host_key": "SHA256:..." }
]

SNMP traps

Turn traps on per site under Settings › Sites and collectors ("Receive SNMP traps here"). The site's collector then listens on UDP 162 (you can pick another port there) for SNMP traps and informs, v1, v2c and v3. Point your devices' trap destination at the collector's address.

A trap is accepted only when it uses one of the site's SNMP logins: a v1/v2c community, or a v3 user whose authentication and encryption check out. Others are dropped. The logins are the ones the site's SNMP checks use, plus any you tick next to the setting.

Traps show on each device's page. A link going down, a restart, failed SNMP logins, a BGP session dropping or a UPS on battery raises an alert straight away. Traps are part of Core; with Log Intelligence they're also searchable with the logs (app:snmptrap).

Upgrading from an older version

Older versions used port 8443 for the server and for master collectors, and 8444 for collector management pages. The installer moves them to 443 when you upgrade, if nothing else on the computer uses 443:

• The server moves to 443 and keeps answering on 8443 until every collector has moved. They move by themselves; nothing needs reinstalling.
• Master collectors move to 443 the same way and keep 8443 open for customer collectors until they've moved.
• A collector's management page moves from 8444 to 443 (on the server's own computer it's turned off, because the web interface shows the same).

Remember to allow 443 in any firewall between computers (the installer only opens the computer's own firewall). Once Settings › Ports and firewall shows nothing using 8443, close it there and remove the old rules from your firewalls.

Rules for each kind of computer

"In" means other computers connect to this one. Optional rules are only needed if you use that feature. The installer opens the incoming ones in Ubuntu's firewall (ufw) or Windows Firewall when it's switched on.

Uplivra server (with its own collector)

The central server: web interface, database, alerts, plus a collector for its own site. Most businesses only need this.

Collector

Checks devices at a site and reports to the Uplivra server.

Log collector

Receives logs (syslog) and keeps them in its own encrypted storage.

Customer collector connecting to an MSP over SSH

A collector at a customer site that reaches its MSP's master collector through an SSH tunnel instead of HTTPS.

MSP master collector

Customer collectors connect through it to the MSP's Uplivra server, over HTTPS or SSH (SSH shown on 2222, since the computer's own SSH usually has 22; 22 works when it's free).

MSP router

An MSP master collector that also routes to customers over GRE/IPsec tunnels. Customer collectors reach it through the tunnels over HTTPS.

Packet capture collector

Records switch SPAN (mirror) ports for Packet Capture. Only the management port has an address; the SPAN ports listen and never send, so they need no rules.

Checking a connection

From the collector, check it can reach the server:

curl -k https://uplivra.yourcompany.com/healthz

It should print a short line with "status":"ok". If it times out, a firewall between them is blocking TCP 443. For SSH to a master collector:

ssh -p 2222 -o BatchMode=yes uplivra@master.yourmsp.com

"Permission denied" or "open failed" means the port is open and the master answered (it doesn't give shells). A timeout means it's blocked.