> For the complete documentation index, see [llms.txt](https://documentation.2pintsoftware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.2pintsoftware.com/2pxe-server/planning/firewall-considerations.md).

# Firewall Considerations

The 2PXE and iPXE Anywhere web service both potentially requires changes to your firewall configuration. Generally changes these are not required if you are using the Microsoft Windows firewall.

2PXE uses the following protocols for booting WinPE images:

* Dynamic Host Configuration Protocol (DHCP)
* Pre-Boot Execution Environment (PXE)
* Trivial File Transfer Protocol (TFTP)
* Hyper Text Transfer Protocol (HTTP)

The following table outlines the User Data Protocol (UDP) and Transmission Control Protocol (TCP) network ports that are used during the process. You can modify the values that have an asterisk (\*) by using the instructions in this manual.

| DHCP & TFTP       | 67\*, 69, 4011\*, Random |        |
| ----------------- | ------------------------ | ------ |
| 2PXE HTTP Traffic |                          | 8050\* |
| iPXE Anywhere     |                          | 8051\* |

#### Step by Step UDP and TCP ports used during image deployment:

1. The client performs a network boot.
2. 2PXE uses DHCP ports and TFTP to download the binary files. For TFTP and DHCP, you need to open ports 67, 69, and 4011. The TFTP and multicast servers use ports in the range 64001 through 65000 by default.
3. In accordance with RFC 1783 (<http://go.microsoft.com/fwlink/?LinkId=81027>), the client chooses random UDP ports to establish the session with the server. If you are using a non-Microsoft firewall, you may need to use an application exception for TFTP on the 2PXE Server.
4. PXE Client downloads the configured boot loader using TFTP.
5. The client downloads Windows PE, typically over HTTP or HTTPS and boots to the Windows Deployment Services client. This download also uses the same TFTP ports as mentioned previously or using HTTP directly from the 2PXE server or from the Configuration Manager DP or any other configured HTTP server.
6. If reporting is enabled, the PXE client will try to communicate over to the iPXE Anywhere Web Service.

The following rules are automatically created when 2PXE starts:

| Name                       | Protocol | File                                                        | Port | InterfaceType |
| -------------------------- | -------- | ----------------------------------------------------------- | ---- | ------------- |
| 2Pint Software 2PXE – TFTP | UDP      | C:\Program Files\2Pint Software\2PXE\2Pint.2pxe.service.exe | 69   | ALL           |
| 2Pint Software 2PXE – DHCP | UDP      | C:\Program Files\2Pint Software\2PXE\2Pint.2pxe.service.exe | 67   | ALL           |
| 2Pint Software 2PXE – PXE  | UDP      | C:\Program Files\2Pint Software\2PXE\2Pint.2pxe.service.exe | 4011 | ALL           |
| 2Pint Software 2PXE – HTTP | TCP      | Any                                                         | 8050 | ALL           |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://documentation.2pintsoftware.com/2pxe-server/planning/firewall-considerations.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.