Firewall ports needed for the XoT Technology services

For all entries it is assumed that return traffic should also be allowed, e.g. via connection tracking.

XoT-Lock (XoT-S1 or Software-XoT)

Incoming

UDP 17396 FROM XoT-Desktop/Headless clients (Bridgeless)
UDP 25006 FROM XoT-Desktop/Headless clients (Bridgeless)

Outgoing

UDP 53 TO DNS servers (whichever are configured)
UDP 123 TO *.pool.ntp.org
TCP 443 TO XMS (MQTT, HTTPS endpoints)
TCP 443 TO discovery.prod.xertified.net

UDP 17396 TO XoT-Bridges
UDP 25010 TO XoT-Bridges

XoT-Desktop/Headless clients and XoT-Daemon services

Outgoing

UDP 53 TO DNS servers (whichever are configured)

TCP 443 TO XMS (MQTT endpoint)

UDP 17395 TO XoT-Lock (Bridgeless)
UDP 25006 TO XoT-Lock (Bridgeless)

UDP 25008 TO XoT-Bridges
UDP 30000-30500 TO XoT-Bridges

XoT-Bridge

Incoming

UDP 25008 FROM XoT-Desktop/Headless clients
UDP 30000-30500 FROM XoT-Desktop/Headless clients

UDP 17396 FROM XoT-Lock
UDP 25010 FROM XoT-Lock

Outgoing

UDP 53 TO DNS servers (whichever are configured)

UDP 123 TO *.pool.ntp.org
TCP 443 TO XMS (MQTT, HTTPS endpoints)
TCP 443 TO discovery.prod.xertified.net

XMS

Incoming

TCP 80 FROM ANY (If using the Let's Encrypt renewal service)
TCP 443 FROM ANY (MQTT, HTTPS endpoints)

Outgoing

UDP 53 TO DNS servers (whichever are configured)
TCP 80 TO Debian packet repository
UDP 123 TO *.pool.ntp.org