Firewalls and corporate networks
Learn what your network needs to allow for nixscale to work, what happens on restrictive networks, and what isn't needed at all.
nixscale is designed to work behind corporate firewalls: it needs no inbound connections and only uses connections the device opens outward. On very restrictive networks, though, a few allowances decide how fast it is.
You don't need to open inbound ports
Your devices don't need to be reachable from the internet, and you don't need to forward ports on your router. That's one of nixscale's most important security properties: your servers stay closed to the internet while your team reaches them.
Outbound allowances
| Destination | Protocol/port | What for | Required |
|---|---|---|---|
Your network's control server (<network-id>.hs.nixscale.com) | TCP 443 | Joining the network and receiving rules | Yes |
| Relay servers | TCP 443 | Relaying traffic when a direct connection isn't possible | Yes |
| Other devices (direct connection) | UDP 41641 | Fast, direct device-to-device connections | No, but strongly recommended |
| Relay servers | UDP 3478 | Network address discovery (STUN) — makes direct connections possible | No, but recommended |
Source: Tailscale's client port requirements.
What if UDP is blocked?
Connections still work: devices carry traffic through a relay over TCP 443. The difference is speed — a relayed connection is slower than a direct one and latency goes up.
If that's noticeable for heavy work like file copies or database traffic, ask your network admin to allow outbound UDP 41641 and UDP 3478.
Things to watch on corporate networks
- TLS inspection. Systems that open and re-sign outbound HTTPS can break the connection to the control server. Exclude
*.hs.nixscale.comfrom inspection. - Static IP filters. Relay servers are distributed worldwide and their addresses can change; allowing outbound TCP 443 by domain or in general is safer.
- Guest and hotel networks. On networks with a captive portal, sign in through the browser first; nixscale connects afterwards.
- Server firewalls. If you restrict outbound connections on your server, allow the list above; you don't need to add any inbound rule.
Devices sharing a local network
If a gateway device shares the local network behind it, IP forwarding must be enabled on that device and its local firewall must allow the traffic: Share a local network.