# Simplified flowchart of Medulla

## Simplified Flow Rules

The rules are interpreted as follows:

- `SOURCE -> DEST` means that the **flow is initiated** from the SOURCE to the DESTINATION.
- If the protocol is not specified, then it defaults to TCP.

##### If you have a single Medulla server, refer to the table:

- 1. Without a Relay Server

##### If you have a Medulla server and a relay server, refer to the table:

- 2. With a Classic Relay Server

##### If you have a Medulla server and a DMZ relay server, refer to the table:

- 3. With a DMZ Relay Server

##### Medulla external access:

- updates.siveo.net:443
- download.windowsupdate.com:80

##### Medulla access to other internal servers:

- Your GLPI server (if you have one)
- Your LDAP server (if you have one; see our LDAP documentation: [LDAP DOC](https://docs.medulla-tech.io/books/medulla-faq/page/active-directory))

##### Access from your Admin Machine to Medulla:

<table id="bkmrk-tron%C3%A7on-direction-du" style="width:100%;height:106.563px;"><thead><tr style="height:46.5938px;"><td style="width:30.7509%;height:46.5938px;">**Connection**</td><td style="width:35.6307%;height:46.5938px;">**Ports Used (DEST)**</td><td style="width:33.6184%;height:46.5938px;">**Notes**</td></tr></thead><tbody><tr style="height:59.9688px;"><td style="width:30.7509%;height:59.9688px;"><span>**Your internal admin workstation ➡️ Medulla server**</span></td><td style="width:35.6307%;height:59.9688px;"><span>139/445</span>

<span>8384</span>

</td><td style="width:33.6184%;height:59.9688px;"><span>Traffic initiated by the **internal admin workstation to**  **Medulla**.</span></td></tr></tbody></table>

#### 1. Without Relay Server

<table id="bkmrk-liaison-ports-utilis" style="width:100%;height:675.094px;"><thead><tr style="height:46.5938px;"><td style="width:30.7509%;height:46.5938px;">**Connection**</td><td style="width:35.6307%;height:46.5938px;">**Ports Used (DEST)**</td><td style="width:33.6184%;height:46.5938px;">**Notes**</td></tr></thead><tbody><tr style="height:180.969px;"><td style="width:30.7509%;height:180.969px;"><span>**Internal workstation ➡️ Medulla server**</span></td><td style="width:35.6307%;height:180.969px;"><span>22 (SSH)  
67/69 (UDP)  
80/443  
111/2049 (TCP &amp; UDP)  
5222  
8443  
9990  
9999,  
22067  
55415  
</span></td><td style="width:33.6184%;height:180.969px;"><span>Traffic initiated by the **extension to**  **Medulla**.</span></td></tr><tr style="height:130.578px;"><td style="width:30.7509%;height:130.578px;"><span>**Medulla server <span>➡️ </span>Internal <span>workstation </span>** </span></td><td style="width:35.6307%;height:130.578px;"><span><span>9  
22 ( </span>SSH)  
3389  
5900  
5985/5986  
35621  
35623  
</span></td><td style="width:33.6184%;height:130.578px;"><span>Traffic initiated by the **Medulla server to**  **internal extensions**.</span></td></tr></tbody></table>

#### 2. With Classic Relay Server

<table id="bkmrk-liaison-ports-utilis-1" style="width:100%;height:840.25px;"><thead><tr style="height:46.5938px;"><td style="width:30.7509%;height:46.5938px;">**Connection**</td><td style="width:35.6377%;height:46.5938px;">**Ports Used (DEST)**</td><td style="width:33.6114%;height:46.5938px;">**Notes**</td></tr></thead><tbody><tr style="height:180.969px;"><td style="width:30.7509%;height:180.969px;"><span>**Internal workstation ➡️ Medulla servers**</span></td><td style="width:35.6377%;height:180.969px;"><span>22 (SSH)  
67/69 (UDP)  
80/443  
111/2049 (TCP &amp; UDP)  
5222  
8443  
9990  
9999,  
22067  
55415  
</span></td><td style="width:33.6114%;height:180.969px;"><span>Traffic initiated by the **extension to**  **Medulla**.</span></td></tr><tr style="height:130.578px;"><td style="width:30.7509%;height:130.578px;"><span>**Medulla servers <span>➡️ </span>Internal <span>workstation </span>** </span></td><td style="width:35.6377%;height:130.578px;"><span><span>9  
22 ( </span>SSH)  
3389  
5900  
5985/5986  
35621  
35623  
</span></td><td style="width:33.6114%;height:130.578px;"><span>Traffic initiated by the **Medulla server to**  **internal workstations**.</span></td></tr><tr style="height:29.7969px;"><td style="width:30.7509%;height:29.7969px;"><span>---</span></td><td style="width:35.6377%;height:29.7969px;"><span>---</span></td><td style="width:33.6114%;height:29.7969px;"><span>---</span></td></tr><tr style="height:97.9844px;"><td style="width:30.7509%;height:97.9844px;"><span>**Medulla Server ➡️ Relay Server**</span></td><td style="width:35.6377%;height:97.9844px;"><span><span>22 ( </span>SSH)</span>

<span>5269  
8081</span>

<span>9990  
22000  
</span>

</td><td style="width:33.6114%;height:97.9844px;"><span>Traffic initiated by **Medulla to** the **DMZ Server**.</span></td></tr><tr style="height:130.562px;"><td style="width:30.7509%;height:130.562px;"><span>**Relay Server <span>➡️ </span>Medulla <span>Server </span>** </span></td><td style="width:35.6377%;height:130.562px;"><span><span>22 ( </span>SSH)</span>

<span>5269  
7080  
8443  
9999  
22067  
22000  
</span>

</td><td style="width:33.6114%;height:130.562px;"><span>Traffic initiated by the **DMZ server to**  **Medulla**.</span></td></tr><tr style="height:29.7969px;"><td style="width:30.7509%;height:29.7969px;"><span>---</span></td><td style="width:35.6377%;height:29.7969px;"><span><span>  
</span></span></td><td style="width:33.6114%;height:29.7969px;"><span>  
</span></td></tr><tr style="height:113.781px;"><td style="width:30.7509%;height:113.781px;"><span>**<span>Internal Station ➡️ Relay Server</span>**</span></td><td style="width:35.6377%;height:113.781px;"><span><span>22</span></span>

<span><span>69/69 (UDP)</span></span>

<span><span>80/443</span></span>

<span><span>111/2049 (TCP &amp; UDP)</span></span>

<span><span>5222</span></span>

9990

</td><td style="width:33.6114%;height:113.781px;"><span><span>Traffic initiated by the **internal extension to** the **Relay Server**.</span></span></td></tr><tr style="height:80.1875px;"><td style="width:30.7509%;height:80.1875px;"><span>**<span>Relay Server ➡️ Internal Station</span>**</span></td><td style="width:35.6377%;height:80.1875px;"><span><span>9</span></span>

<span><span>22</span></span>

<span><span>3389</span></span>

<span><span>5900</span></span>

</td><td style="width:33.6114%;height:80.1875px;"><span><span>Traffic initiated by the **Relay Serverto**the **internal extension**.</span></span></td></tr></tbody></table>

#### 3. With DMZ Relay Server

<table id="bkmrk-liaison-ports-utilis-2" style="width:100%;height:759.078px;"><thead><tr style="height:46.5938px;"><td style="width:30.7509%;height:46.5938px;">**Connection**</td><td style="width:35.6307%;height:46.5938px;">**Ports Used (DEST)**</td><td style="width:33.6184%;height:46.5938px;">**Notes**</td></tr></thead><tbody><tr style="height:180.969px;"><td style="width:30.7509%;height:180.969px;"><span>**Internal workstation ➡️ Medulla Server**</span></td><td style="width:35.6307%;height:180.969px;"><span>22 (SSH)  
67/69 (UDP)  
80/443  
111/2049 (TCP &amp; UDP)  
5222  
8443  
9990  
9999,  
22067  
55415  
</span></td><td style="width:33.6184%;height:180.969px;"><span>Traffic initiated by the **extension to**  **Medulla**.</span></td></tr><tr style="height:130.578px;"><td style="width:30.7509%;height:130.578px;"><span>**Medulla server <span>➡️ </span>Internal <span>workstation </span>** </span></td><td style="width:35.6307%;height:130.578px;"><span><span>9  
22 ( </span>SSH)  
3389  
5900  
5985/5986  
35621  
35623  
</span></td><td style="width:33.6184%;height:130.578px;"><span>Traffic initiated by the **Medulla server to**  **internal workstations**.</span></td></tr><tr style="height:29.7969px;"><td style="width:30.7509%;height:29.7969px;"><span>---</span></td><td style="width:35.6307%;height:29.7969px;"><span>---</span></td><td style="width:33.6184%;height:29.7969px;"><span>---</span></td></tr><tr style="height:113.781px;"><td style="width:30.7509%;height:113.781px;"><span>**Medulla Server ➡️ DMZ Relay Server**</span></td><td style="width:35.6307%;height:113.781px;"><span><span>22 ( </span>SSH)</span>

<span>4369</span>

<span>4370 to 4380  
5269  
8081  
22000  
</span>

</td><td style="width:33.6184%;height:113.781px;"><span>Traffic initiated by **Medulla to** the **DMZ Server**.</span></td></tr><tr style="height:164.172px;"><td style="width:30.7509%;height:164.172px;"><span>**DMZ Relay Server<span>➡️ </span>Medulla<span>Server </span>** </span></td><td style="width:35.6307%;height:164.172px;"><span><span>22 ( </span>SSH)</span>

<span>4369</span>

<span><span>4370 to 4380</span>  
5269  
7080  
8443  
9999  
22067  
22000  
</span>

</td><td style="width:33.6184%;height:164.172px;"><span>Traffic initiated by the **DMZ server to**  **Medulla**.</span></td></tr><tr style="height:29.7969px;"><td style="width:30.7509%;height:29.7969px;"><span>---</span></td><td style="width:35.6307%;height:29.7969px;"><span>---</span></td><td style="width:33.6184%;height:29.7969px;"><span>---</span></td></tr><tr style="height:63.3906px;"><td style="width:30.7509%;height:63.3906px;"><span>**External Host ➡️ DMZ Server**</span></td><td style="width:35.6307%;height:63.3906px;"><span><span>22 ( </span>SSH)  
5222</span></td><td style="width:33.6184%;height:63.3906px;"><span>Traffic initiated by the **external workstation to** the **DMZ server**.</span>

</td></tr></tbody></table>

#### Port descriptions

Port 9: used for Wake on LAN (WOL) to wake up a remote workstation.  
  
Port 22 (SSH): SSH port used by Medulla for remote operations, command execution, and agent administration.  
  
Ports 67 and 69 (UDP): used for DHCP and TFTP, particularly during PXE boot or for loading deployment images.  
  
Ports 80 and 443: HTTP and HTTPS, used for web access and secure communication with Medulla services.  
  
Port 111 (TCP and UDP): used by Portmapper / RPCbind, required for NFS services and certain internal network calls.  
  
Port 3389: used for RDP to connect remotely to Windows workstations.

Port 4369: used for an ejabberd cluster if you have a DMZ relay

Ports 4370 to 4380: used for an ejabberd cluster if you have a DMZ relay  
  
Port 5222: used by XMPP for communication between Medulla agents and the server.  
  
Port 5269: used by XMPP for server-to-server communication, particularly between Medulla and the DMZ relay server.  
  
Port 5900: used by VNC for remote control.  
  
Ports 5985 and 5986: used by WinRM (HTTP and HTTPS) for remote commands on Windows.  
  
Ports 7080 and 8081: used by internal services or management APIs required by the relay server or Medulla components.  
  
Port 8443: HTTPS used by Medulla’s secure interface or APIs.  
  
Port 9990: used by an internal Medulla service for management and monitoring.  
  
Port 9999: used as an internal synchronization or exchange port between the Medulla server and components such as the relay.  
  
Port 22000: used by Syncthing as the main channel for data synchronization (packages, artifacts, inventories).  
  
Port 22067: used by Syncthing as a relayed channel, useful for mobile devices or those located behind a NAT.  
  
Ports 35621, 35623, and 55415: dynamic ports used by Medulla agents for real-time communication, inventory, synchronization, or task execution.