Network requirements

Continuum Local makes outbound connections only. It listens on no port, so it needs no inbound firewall rule and no public address. The Helm chart creates no Service and no Ingress.

Outbound connections

Destination	Port	Protocol	Purpose
`blueprintr.io`	TCP 443	HTTPS	Enrolment, and polling for work whenever the agent is not using the gateway
`agents.blueprintr.io`	TCP 443	HTTPS, and WebSocket over TLS (WSS)	The agent gateway: a WebSocket that tells the agent when work is waiting, plus its polls and sweep uploads while it uses the gateway
Each on-premise system	TCP, the port in its URL in Blueprintr (defaults below)	HTTPS	The read requests Continuum Link makes through the agent
Each address in `discovery.cidrs`	UDP 161, or `discovery.port`	SNMP	Network sweeps. Only with a `discovery` block
A host in an integration's `allowedHosts`	UDP, the port the probe gives	SNMP	An SNMP probe of one device. Only with a `discovery` block
Your DNS resolvers	53	DNS	Resolving the hosts above, unless a proxy resolves the Blueprintr hosts for the agent

An agent uses the gateway only after Blueprintr has advertised it, and polls blueprintr.io before that. Allow both hosts, so the agent can move to the gateway without a firewall change. The agent does not depend on the gateway. If it cannot open the WebSocket, it keeps working by polling. If the gateway stops answering polls, the agent polls blueprintr.io and tries the gateway again every five minutes.

The agent never downloads or updates itself. You install each upgrade.

On-premise systems

Allow TCP from the agent's host to each system's API port. A port you write in the connector's URL in Blueprintr replaces the default.

Connector	Default port
SolarWinds Orion	17774 (SWIS)
Zabbix	443
PRTG Network Monitor	443
Checkmk	443
Icinga 2	5665
ManageEngine OpManager	8060. Write it in the URL: without a port, the connector uses 443
WhatsUp Gold	9644
NetBox	443
Infoblox NIOS	443
Veeam Backup & Replication	9419

allowedHosts in the agent's configuration matches host names only, and any port on a listed host is allowed. Control ports with your firewall. The agent follows at most three redirects, and checks each one against allowedHosts again.

Network sweeps

A sweep sends SNMP GET, GETNEXT and GETBULK requests over UDP from the agent's host to port 161 on each address it probes, and needs the replies back. Sweeps are IPv4 only, and the discovery settings limit them. The agent sends at most discovery.packetsPerSecond packets a second (50 by default), shared by every sweep and probe it runs. It does not use ICMP or scan ports. Your intrusion detection sees SNMP requests from the agent's address.

Proxies

Traffic to Blueprintr can go through an HTTP or HTTPS proxy. Set proxy and noProxy in config.json, or HTTPS_PROXY and NO_PROXY in the agent's environment. The configuration file wins. Without it, the agent reads HTTPS_PROXY, then https_proxy, then HTTP_PROXY, and NO_PROXY, then no_proxy.

Enrolment, polls, sweep uploads and the gateway WebSocket go through the proxy. It must allow a CONNECT tunnel to port 443 on both Blueprintr hosts.
Connections to your on-premise systems and SNMP sweeps never use the proxy, whatever HTTPS_PROXY says, so an internal host name is never sent to it.
SOCKS proxies are not supported.
For a proxy that needs a user name and password, write http://user:[email protected]:3128. The password is masked in every log line. Put the URL behind env: or file: to keep it out of config.json.
A proxy needs Node.js 24 or later. The packages and the container include it. The bare bundle on an older Node.js refuses to start with a proxy configured, rather than going direct.

Where to put the setting:

Install	Where
Debian, Ubuntu, RHEL, Rocky, Alma	`config.json`, or `/etc/continuum-local/environment`, which systemd reads as root before starting the agent. That file is mode 0600 because a proxy URL can contain a password
Windows	`config.json`. Environment variables added to the service are replaced by every upgrade, and a machine-wide `HTTPS_PROXY` reaches the service only after a reboot
Container	`config.json`, or `-e HTTPS_PROXY=... -e NO_PROXY=...`
Helm chart	`config.json`, or `extraEnv`. Read a URL that contains a password from a Secret with `valueFrom`

TLS-inspecting proxies

A proxy that re-signs TLS shows the agent its own certificate for blueprintr.io, and the agent refuses it until it trusts the proxy's root. Give the agent that root certificate, in PEM form, as extraCaFile. The agent trusts that file for Blueprintr only, never for your on-premise systems, because a proxy's root can sign a certificate for any name.

trustSystemCa, on by default, trusts the operating system's certificate store as well. A proxy root already installed there works without extraCaFile.
Avoid NODE_EXTRA_CA_CERTS for a proxy's root. Node.js reads it itself and trusts it for every connection, your on-premise systems included.
A DER file is refused at start. Convert it with openssl x509 -inform der -in proxy-root.cer -out proxy-root.pem.
A proxy that inspects TLS must also let the WebSocket upgrade to agents.blueprintr.io through. If it does not, the agent polls instead.

Firewalls and allow-lists

Allow the Blueprintr hosts by name. Blueprintr publishes no fixed IP addresses for blueprintr.io or agents.blueprintr.io, and the addresses behind them can change. A firewall or proxy that filters on DNS names or on the TLS server name can allow them.
Requests to your monitoring systems come straight from the agent, never through the proxy. If a system limits its API to certain source addresses, add the address the agent's traffic leaves from.
Devices that limit SNMP to named managers need the agent's address in that list.

Checking the route

Run continuum-local check on the agent's host, with the command Troubleshooting gives for each platform. It resolves each Blueprintr host, opens a TCP connection and a verified TLS handshake, through the proxy when one is set, and does the same directly with every host an integration may reach, on port 443 unless you pass --port. It sends nothing beyond the handshake.