Use this page when you're configuring firewalls for Lansweeper Classic. Each section covers one connection, names the machine the ports must be open on, and lists the ports involved.
Sections are grouped by what's connecting to what: your Lansweeper components talking to each other, your scanning servers reaching the assets they scan, and outbound connections to Lansweeper cloud services.
To check the status of your ports, see the Ports Status pro tip.
Lansweeper components
Web console access
Open these ports on the machine hosting the web console.
| Port | Purpose |
|---|---|
| HTTP port specified in the Lansweeper installer | Web console access |
| HTTPS port specified in the Lansweeper installer | Web console access over SSL, when the default web server (IIS Express) is used |
When using the alternate IIS web server, configure an HTTPS port directly in IIS Manager.
Lansweeper service and web console to the SQL Server database
Open these ports on the machine hosting your SQL Server instance.
| Port | Purpose |
|---|---|
| 1433/TCP | SQL Server traffic |
Which ports you need to open depends on how your instance is configured. Port 1433 is common for SQL Server traffic, but additional ports may be needed. See Microsoft's guide on configuring the Windows Firewall to allow SQL Server access for details.
Scanning targets
To Active Directory domain controllers
Open these ports on your domain controllers.
| Port | Purpose |
|---|---|
| 389/TCP | LDAP, or another LDAP(S) port of your choice |
| 88 | Kerberos, if Kerberos is enabled or enforced |
To scanned Windows computers
Open these ports on the Windows computers you scan.
| Port | Purpose |
|---|---|
| 135/TCP | DCOM, to establish the initial WMI session |
| 139/TCP | NetBIOS Session Service |
| 445/TCP | SMB |
| 1025-5000 or 49152-65535 | Random ports used to send the WMI data |
By default, Windows sends WMI data over random ports, as explained in Microsoft's guide to connecting to WMI on a remote computer. You have three options:
- Configure your firewalls to allow all WMI traffic. Windows Firewall has a remote administration exception you can enable, as described in configure Windows Firewall for agentless scanning of computers. For third-party firewalls, consult your firewall's documentation.
- Configure a fixed WMI port and allow traffic through it.
- If you can't allow WMI traffic through your firewalls, scan those computers with the LsAgent or LsPush scanning agent instead. Neither requires firewall reconfiguration.
To scanned Linux, Unix, and Mac computers
Open this port on the computers you scan.
| Port | Purpose |
|---|---|
| 22/TCP | SSH, or a custom SSH port of your choice |
To scanned VMware servers
Open this port on the VMware servers you scan.
| Port | Purpose |
|---|---|
| 443/TCP | HTTPS |
To scanned network devices
Open these ports on the network devices you scan. Lansweeper also uses ICMP ping.
| Port | Purpose |
|---|---|
| 21/TCP | FTP |
| 22/TCP | SSH, or a custom SSH port of your choice |
| 23/TCP | Telnet |
| 25/TCP | SMTP |
| 80/TCP | HTTP |
| 135/TCP | EPMAP |
| 137/UDP | NetBIOS Name Service |
| 139/TCP | NetBIOS Session Service |
| 161 | SNMP |
| 443/TCP | HTTPS |
| 445/TCP | SMB |
| 1400/TCP | Sonos devices HTTP |
| 1900/TCP | SSDP, UPnP |
| 1900/UDP | SSDP, UPnP |
| 5060 | SIP, or a custom SIP port of your choice |
| 5353/TCP | mDNS, DNS-SD |
| 5353/UDP | mDNS, Bonjour, DNS-SD |
| 5985/TCP | WinRM without SSL, for Windows cluster log and Hyper-V log scanning |
| 5986/TCP | WinRM with SSL, for Windows cluster log and Hyper-V log scanning |
| 8008/TCP | Chromecast |
| 8080/TCP | HTTP |
| 8443/TCP | HTTPS |
| 9100/TCP | JetDirect |
| 16992/TCP | Intel vPro HTTP |
| 16993/TCP | Intel vPro HTTPS |
| 62078/TCP | iTunes sync port, for iOS device identification |
Scanning agents
Scanned computers to the Lansweeper service
Applies when LsAgent or LsPush sends data directly to your Lansweeper server. Open this port in the firewall of the scanning server, meaning the server hosting the Lansweeper Server service.
| Port | Purpose |
|---|---|
| 9524/TCP | Direct agent connection, or a custom port of your choice |
You can choose a custom port in the Service Options section of the Configuration > Server Options menu.
Scanned computers to the Network Discovery hub
Applies when the IT Agent (portable) is used for discovery with a direct connection. Open this port in the firewall of the Lansweeper Network Discovery hub, meaning the server hosting the hub service.
| Port | Purpose |
|---|---|
| 59525/TCP | Direct IT Agent connection, or a custom port of your choice |
To use a custom port, change every instance of 59525 in C:\Program Files\Lansweeper Network Discovery\hub\appsettings.json and restart the Lansweeper Network Discovery hub service.
Outbound connections to Lansweeper cloud services
Scanning server to the LsAgent relay server
Required only if you scan computers over the internet with LsAgent. Allow this outbound connection from your Lansweeper scanning server.
| Destination | Port | Purpose |
|---|---|---|
lsagentrelay.lansweeper.com |
443/TCP | Retrieve data scanned by LsAgent from the cloud relay server |
For more on how the relay works, see Introduction to LsAgent for Windows, Linux and Mac.
Linking to Lansweeper Platform
If you link your installation to a Lansweeper Platform site, your web server and sync server both need internet access. See cloud linking requirements for the prerequisite checks, and Lansweeper features that access the internet for the URLs involved.