Skip to main content

Network Prerequisites for Medulla SaaS

 Medulla / All Versions / Shared SaaS - Private SaaS / Infrastructure

1. Are there any technical prerequisites for using Medulla in SaaS mode?

For the shared SaaS offering, no hardware or software prerequisites are required.

The only requirement is to allow two outbound network connections from your workstations to the Medulla platform.

2. Which ports must be open on the Internet?

Shared SaaS

Only two ports need to be allowed:Workstations → Medulla Server:

  • TCP 2002: primary communication between the Medulla agent and the server

  • TCP 5222: XMPP channel used to orchestrate actions and establish secure tunnels

No other ports should be open to the Internet.

3. Why only two ports?

Because:

  • All operations requiring additional ports (VNC, RDP, WinRM, inventory, package deployments) automatically pass through an OpenSSH tunnel established between the Medulla server and the agent on the workstation.

  • This tunnel is initiated and managed by the XMPP service.

Therefore, you do not need to expose sensitive ports to the Internet.

4. Which ports are required for the dedicated SaaS offering?

In addition to the ports required for the shared SaaS offering:

  • TCP 55415: used for Backup functions

All other ports continue to pass through the OpenSSH tunnel and do not need to be opened.

5. Why are certain ports (UDP 67, 69, 111, 2049) no longer listed in SaaS mode?

Because they arenot used in SaaS mode:

  • No PXE or DHCP over the Internet →UDP 67 and 69 are unnecessary

  • No exposed NFS → 111 / 2049 are unnecessary

  • No low-level services are exposed in the Medulla cloud

6. Do I need to open inbound ports on my firewall?

No.

No incoming traffic is required in Medulla SaaS mode.

Your firewall simply needs to allow the following outbound traffic so that the agents can communicate:

  • TCP 2002

  • TCP 5222

    (+ TCP 55415 if using dedicated SaaS)

7. Quick Summary

Offer

Required Data Flows: Workstations → Server

Notes

Shared SaaS

TCP 2002, TCP 5222

All other ports go through the OpenSSH tunnel

Dedicated SaaS

TCP 2002, TCP 5222, TCP 55415

Optional backup enabled

Incoming traffic

None

Everything is initiated by the workstation

Back to top