Connectivity & ports
This page lists what a device needs to reach on the network and what it accepts on its own interfaces, so you can plan firewall rules for the sites where your devices run.
Outbound connectivity (required)
A device reaches the SPEKTRA Edge platform over secure, outbound connections. Devices do not need any inbound connections from the platform — all communication is initiated by the device.
| Destination | Port | Purpose |
|---|---|---|
| SPEKTRA Edge platform endpoints | TCP 443 | Provisioning, configuration, telemetry, log forwarding, and remote access — all over TLS. |
| Time sources | UDP 123 | Network time synchronization. See Time synchronization. |
| Public STUN servers | UDP | External IP address discovery. |
At minimum, allow outbound TCP 443 to the platform and outbound UDP 123 to your time sources. If you use a proxy, the device’s platform traffic egresses through it.
Inbound (on the device)
By default a device exposes only what is needed to administer it locally:
| Port | Purpose |
|---|---|
| TCP 22 | SSH access. Can be restricted or disabled — see SSH access. |
The device also responds to local network discovery (mDNS) so it can be found by name on the local segment; this can be turned off with the device discovery setting.
Any ports your workloads expose are determined by the workloads you deploy, not by the OS.
Remote access does not require inbound ports
Operator actions such as opening a remote shell, transferring files, or streaming logs are carried over the device’s existing outbound connection to the platform. You do not need to open inbound ports to use them. See Remote access.
Firewall planning checklist
- Allow outbound TCP 443 to the SPEKTRA Edge platform (directly or via proxy).
- Allow outbound UDP 123 to your NTP sources.
- Allow outbound UDP to your chosen STUN servers (or accept that external IP discovery is unavailable).
- Decide whether local TCP 22 (SSH) should be reachable on your LAN.
- Open any ports your workloads require, per workload.