Network and firewall requirements
| Source | Destination | Protocol/port | Purpose | | --- | --- | --- | --- | | Administrators | Management Server | TCP 8443 | Web UI and node report/config end
Network and firewall requirements
Required flows
| Source | Destination | Protocol/port | Purpose |
|---|---|---|---|
| Administrators | Management Server | TCP 8443 | Web UI and node report/config endpoint |
| Management Server | SMB and DNS nodes | TCP 9443 | Active encrypted policy and reputation push |
| SMB and DNS nodes | Management Server | TCP 8443 | Enrollment validation, heartbeats, telemetry, pull recovery |
| SMB clients | SMB Proxy Node | TCP 445 | Proxied SMB sessions |
| SMB Proxy Node | File server | TCP 445 | Backend SMB connection |
| DNS clients or internal DNS | DNS Security Node | UDP/TCP 53 | DNS queries |
| DNS Security Node | Upstream resolvers | UDP/TCP 53 | Approved DNS forwarding |
Allow SSH only from approved administration networks when Linux access is required.
Internet access
| Role | Direct internet required? | Notes |
|---|---|---|
| Management | No | Core management and offline licensing work without internet. Internet may be allowed through controlled update procedures. |
| SMB Proxy | No | Requires only Management and backend file-server connectivity. Reputation is synchronized from Management. |
| DNS Security | Conditional | Public upstream DNS and remote threat feeds require egress. Internal upstream resolvers can keep the node offline. |
The customer portal and marketing website run outside the customer network and are not in the SMB or DNS traffic path.
Direction matters
Node reporting is initiated from each node to Management on 8443. Policy push is initiated from Management to the node control listener on 9443. Opening only one direction results in a node that may appear online but cannot receive immediate policy, or a node that receives push but cannot report health.
SMB anti-bypass boundary
The network firewall must enforce the product architecture. Do not rely only on user instructions or DNS aliases.
Clients --TCP/445--> Axiom SMB --TCP/445--> File Server
Clients --TCP/445--> File Server DENY
The SMB node should not route packets between interfaces. Axiom proxies at the application stream level; it is not a Linux forwarder or NAT gateway.
DNS and Active Directory
For AD environments, keep endpoints pointed at AD DNS. Configure the DC DNS forwarder to use the Axiom DNS node, then let Axiom forward allowed external queries to internal or public upstream resolvers. Validate AD service records before changing the forwarding chain.
TLS
Use a trusted enterprise certificate on Management in production. Every DNS and SMB node must use the Management URL whose host or IP appears in the certificate SAN. If using a private CA, distribute that CA to nodes and administrator browsers. The installer can allow invalid Management TLS for a self-signed lab certificate, but that option should not become a production default.