[KB332] Ports and addresses required to use your ESET application with a third-party firewall

Issue

Solution

Home and small office users

ESET Bridge whitelisting

To enable OAuth2 authentication for the Notification email forwarding feature in ESET Endpoint applications, you must whitelist the following address in ESET Bridge:

login.microsoftonline.com

Your ESET application communicates with resources on the internet using the standard HTTP protocol on port 80 or HTTPS on port 443.

To resolve your issue, the following hosts in each ESET component must be made accessible:

• Download detection engine and module updates
• Download pico updates
• Download application installers, updates
• Expiration date
• Support requests
• ESET Secure Authentication Provisioning Server
• ESET LiveGrid®
• Advanced Machine Learning
• Anonymous statistics
• Web Control/Parental Control
• Password Manager
• Antispam
• GUI
• Mobile Security
• ESET Data Framework (Anti-Theft, ESET PROTECT Hub, ESET Business Account, Parental control, Web control)
• ESET PROTECT On-Prem
• ESET PROTECT
• ESET Inspect
• ESET Connect
• ESET Push Notification Service
• ESET LiveGuard Advanced
• Services
• Online Help and Knowledgebase
• MSP
• DNS load balancers
• Telemetry
• Certificate Revocation Checks (OCSP)
• Syslog security restrictions and limits
• Receiving emails from ESET systems

ESET Antimalware SDK

Requirements for IP addresses and hostnames

Required IP addresses and hostnames for ESET Antimalware SDK:

• Detection engine updates
• DNS load balancers
• ESET Data Framework

For the ESET Antimalware SDK version 1.6 and later, allow also these additional IP addresses and hostnames.

In the Services section, the IP addresses and hostnames listed for iploc.eset.com are required, but the IP addresses and hostnames listed for pki.eset.com are required only until the contents of the "license/PKI" folder are cached at least once.

Requirements for ports

ESET Antimalware SDK requires both port 80 and port 443 to function:

• Port 80 is used for module updates and first-time caching of PKI
• pki.eset.com (for the first time only)
• Port 443 is used for activation, IP location requests, and similar requests
• edf.eset.com
• iploc.eset.com

To download detection engine updates:

To download detection engine updates, use this hostname:

• update.eset.com

To download detection engine updates only from servers located in a specific region, select one of these hostnames:

• Europe: eu-update.eset.com
• US: us-update.eset.com

To download pico updates:

To download application installers, updates:

To see the expiration date:

• Ensure the port TCP/UDP 443 is open for all edf.eset.com IP addresses listed below

To send support requests using the Support request function:

To allow communication with ESET Secure Authentication Provisioning Server (two-factor authentication):

Servers:

To use the online reputation database (ESET LiveGrid®):

• Ensure the following ports are open for all IP addresses listed below: TCP 80, TCP 53535, UDP 53535
• The IP addresses below have to be enabled for HTTP port 80
• Users on ESET Endpoint version 7.x and earlier, access to your local DNS server is required for DNS queries on UDP/TCP port 53 
• Users on ESET Endpoint version 8.0 and later, access to your local DNS server is required for DNS queries and must be able to resolve hostnames

Domains used by ESET LiveGrid®:

These IP addresses need to be enabled for HTTP port 80. Also, access to your local DNS server is required for DNS queries on UDP/TCP port 53.

Advanced Machine Learning:

To submit suspicious files and anonymous statistical information to ESET's Threat Lab:

• edtd-ts.eset.com

To use the Web control/Parental Control module:

• Base domain for DNS queries: e5.sk
• Open UDP port 53535 for the addresses in the table below and allow requests to your local DNS server (ESET Endpoint version 8.0 and later must be able to resolve hostnames. ESET Endpoint version 7.x and earlier UDP/TCP port 53).

To use ESET Password Manager:

To use the Antispam module:

• Version 5 and later: You need to allow requests to your local DNS server (ESET Endpoint version 8.0 and later must be able to resolve hostnames. ESET Endpoint version 7.x and earlier UDP/TCP port 53).
• Base domain for DNS queries: e5.sk

• Version 4: You only need to allow requests to your local DNS server (port 53)

• Version 3:

Domains used by the Antispam module:

Back to top

These IP addresses must be enabled for HTTP port 80 (used for downloading updates of the Antispam database). Also, access to your local DNS server is required for DNS queries on UDP/TCP port 53 (ESET Endpoint version 8.0 and later must be able to resolve hostnames. ESET Endpoint version 7.x and earlier UDP/TCP port 53).

To ensure proper functionality of linking and redirection from your ESET applications's main program window:

To activate ESET Mobile Security:

ESET Data Framework (Anti-Theft, ESET PROTECT Hub, ESET Business Account, Parental control, Web control):

• Ensure the port TCP/UDP 443 is open for all IP addresses listed below
• Ensure the following ports are open for all ARS servers (hx-arsexx-v.eset.com) IP addresses listed below: TCP/UDP 53, TCP/UDP 80, TCP/UDP 53535

ESET Repository–repository.eset.com (ESET PROTECT On-Prem):

The IP address of the ESET repository server in China: 161.189.152.208

• Some locations (such as Japan, Australia, or New Zealand) might have different IP addresses because of using CDN.
• Use repositorynocdn.eset.com to connect ESET repository servers only; however, in this case, the best internet connection cannot be guaranteed.
• Ensure HTTP 1.1 is enabled when accessing the repository or ESET update servers via third-party proxy. This applies to all applications that have access to the ESET repository.

For more information, see ESET PROTECT On-Prem repository is not working.

ESET Endpoint Security and ESET Endpoint Antivirus auto-updates

ESET Endpoint Security and ESET Endpoint Antivirus connect to repository.eset.com when the Micro PCU is executed.

Network configuration for ESET PROTECT

Allow the network prerequisites below in your firewall for ESET PROTECT to work correctly.

Domains and ports

IP addresses

Find network prerequisites for ESET Connect in the ESET Connect Online Help.

Back to top

Network configuration for ESET Inspect

The outbound connection in your network's firewall must be allowed for ESET Inspect to work correctly:

Find network prerequisites for ESET Connect in the ESET Connect Online Help.

Back to top

ESET Push Notification Service

ESET Push Notification Service (EPNS) sends Wake-Up calls between ESET Management Agents and ESET PROTECT On-Prem/ESET PROTECT server.

ESET LiveGuard Advanced:

Users need to whitelist both addresses for each hostname.

Services (activation, expiration, IP location, trace, version check, redirector, in-app images & messages, SSL certificate check):

Linking and redirection:

Activation:

• Ensure the port TCP/UDP 443 is open for all iploc.eset.com and edf.eset.com IP addresses listed below
• Ensure the port TCP/UDP 80 is open for all pki.eset.com IP addresses listed below

Trace - Installation statistics:

In-app images & messages:

SSL Certificate check:

Online help and Knowledgebase:

ESET MSP Utility (EMU)

DNS load balancers

ESET DNS service for eset.com domains is often used for optimal distribution of requests to ESET’s resources.

• Ensure the following ports are open for all IP addresses listed below: TCP/UDP 53535, TCP/UDP 53

Telemetry

Telemetry services:

Certificate Revocation Checks (OCSP)

Some third-party applications (for example, web browsers) check the revocation status of SSL/TLS certificates via Online Certificate Status Protocol (OCSP).

Syslog security restrictions and limits

Due to the security requirements for Syslog server connection, the following settings are fixed and cannot be changed:

• Transport protocol: TLS
• TCP port: 6514

For the same reasons, there are additional requirements on the receiving Syslog server:

• IP address: Globally routable IPv4 address
• IDN names: Must use ASCII representation ("xn--")
• FQDN: Must translate to a single fixed IPv4 address

Administrators should configure their Syslog server's firewall to allow incoming Syslog Export events only from the following IP ranges:

• Outgoing IP addresses from ESET PROTECT in the Europe region:

  51.136.106.164

  51.136.106.165

  51.136.106.166

  51.136.106.167

  20.16.120.5

• Outgoing IP addresses from ESET PROTECT in the USA region:

  40.81.8.148

  40.81.8.149

  40.81.8.150

  40.81.8.151

  40.86.163.190

• Outgoing IP addresses from ESET PROTECT in the Japan region:

  20.78.10.184

  20.78.10.185

  20.78.10.186

  20.78.10.187

  48.210.54.247

• Outgoing IP addresses from ESET PROTECT in the Canada region:

  20.48.241.160

  20.48.241.161

  20.48.241.162

  20.48.241.163

  52.138.52.138

• Outgoing IP addresses from ESET PROTECT in the Germany region:

  20.170.86.116

  4.184.232.133

Back to top

Receiving emails from ESET systems

To receive emails from ESET PROTECT Hub, ESET Business Account, ESET MSP Administrator, ESET HOME, etc., ensure the following sender IP address is allowed on your mail server and all related systems:

Back to top