> For the complete documentation index, see [llms.txt](https://documentation.2pintsoftware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.2pintsoftware.com/2pxe-server/4.0/planning/firewall-considerations.md).

# Firewall Considerations

2PXE and the iPXE Anywhere Web Service might both require changes to your firewall configuration. Generally, these changes are not required if you are using Windows Firewall.

2PXE uses the following protocols for booting WinPE images:

* Dynamic Host Configuration Protocol (DHCP)
* Preboot Execution Environment (PXE)
* Trivial File Transfer Protocol (TFTP)
* Hypertext Transfer Protocol (HTTP)

The following table outlines the User Datagram Protocol (UDP) and Transmission Control Protocol (TCP) network ports that are used during the process. You can change the values that have an asterisk (\*) in the **Configure 2PXE** configuration editor.

| Traffic                                                                               | UDP                  | TCP                          |
| ------------------------------------------------------------------------------------- | -------------------- | ---------------------------- |
| DHCP, PXE & TFTP                                                                      | 67, 69, 4011, random |                              |
| 2PXE web service (HTTPS)                                                              |                      | 8050\* (`RunOnHttpPort`)     |
| 2PXE web service (HTTP), used for UEFI HTTP Boot and for setting the clock on devices |                      | 8049\* (`RunOnNonHttpsPort`) |
| iPXE Anywhere Web Service                                                             |                      | 8051\*                       |

The 2PXE server also needs outbound HTTPS access to:

* `https://api.service.2pintsoftware.com`, to request its certificates (see [Certificate Considerations](/2pxe-server/4.0/planning/certificate-considerations.md)).
* The StifleR server, when **Use Infrastructure** is turned on (for example port 9000).

#### Step-by-step UDP and TCP ports used during image deployment

1. The client performs a network boot.
2. 2PXE uses the DHCP ports and TFTP to download the binary files. For TFTP and DHCP, you need to open ports 67, 69, and 4011. The TFTP and multicast servers use ports in the range 64001 through 65000 by default.
3. In accordance with RFC 1783 (<http://go.microsoft.com/fwlink/?LinkId=81027>), the client chooses random UDP ports to establish the session with the server. If you are using a non-Microsoft firewall, you may need to use an application exception for TFTP on the 2PXE Server.
4. The PXE client downloads the configured boot loader using TFTP.
5. The client downloads Windows PE, typically over HTTP or HTTPS, directly from the 2PXE server, the Configuration Manager DP, or another configured HTTP server. With Windows boot loaders, this download uses the TFTP ports mentioned previously instead.
6. If reporting is enabled, the PXE client communicates with the iPXE Anywhere Web Service.

The following inbound rules are automatically created (or updated) when 2PXE starts:

| Name                        | Protocol | Port                         | Created when                                                     |
| --------------------------- | -------- | ---------------------------- | ---------------------------------------------------------------- |
| 2Pint Software 2PXE - TFTP  | UDP      | 69                           | **RunTftpServer** and **FWTFTP** are on                          |
| 2Pint Software 2PXE - DHCP  | UDP      | 67                           | **RunOnDhcpPort** and **FWDHCP** are on                          |
| 2Pint Software 2PXE - PXE   | UDP      | 4011                         | **RunOnPxePort** and **FWPROXYDHCP** are on                      |
| 2Pint Software 2PXE - HTTPS | TCP      | 8050 (**RunOnHttpPort**)     | **RunHttpServer** and **FWHTTP** are on                          |
| 2Pint Software 2PXE - HTTP  | TCP      | 8049 (**RunOnNonHttpsPort**) | **RunHttpServer** and **FWHTTP** are on, and the port is not `0` |

All of these settings are on by default. If you use a different firewall, or turn these settings off, create equivalent rules yourself.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://documentation.2pintsoftware.com/2pxe-server/4.0/planning/firewall-considerations.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.