some file

FAQ

Which firewall ports does the Netzilo client need?

Inbound: none. The client negotiates connections through the signal and relay services, so no inbound port has to be open.

Outbound:

  • TCP 443 to the management, signal and relay hosts.
  • UDP to any port, for direct connections between peers. Without UDP the client still works, through a relay, with higher latency.
  • On Netzilo Cloud, browsers that use clientless access also reach the Netzilo gateway on TCP 8443.

Allow host names rather than IP addresses where your equipment supports it, because addresses can change. If your network inspects TLS, exempt these hosts: the client checks the certificates itself, and inspection breaks the connection.

What are the Netzilo Cloud addresses?

ServiceAddress
Dashboardhttps://go.netzilo.com
Management (the client's default)https://srv.netzilo.com:443
Downloadshttps://pkg.netzilo.com
Documentationhttps://doc.netzilo.com

A self-hosted Netzilo Server serves the dashboard, management, signal and sign-in on one domain, on port 443.

Which ports does a self-hosted server need?

See Server reference for the full list. In short: TCP 80 and 443, TCP and UDP 3478 and 5349 for the relay, and TCP 8443 for the clientless-access gateway.

Can Netzilo read our network traffic?

No. Traffic between peers is end-to-end encrypted with WireGuard. The control plane hands out public keys and policies, but never holds the keys that decrypt the tunnels. Traffic that goes through a relay stays encrypted.

The AI security features are different: when an AI-security rule matches, the event includes the content that triggered it. Through the Netzilo AI Gateway, prompts and answers travel through your own gateway host to the provider you configured. The management server receives usage facts (who, which model, tokens, cost) and detections, never the prompt or the answer.

Where is our data stored?

On a self-hosted Netzilo Server, in your own server's database and volumes. On Netzilo Cloud, in Netzilo's hosted environment.

Why did a device log out after netzilo down or a service restart?

netzilo down, netzilo service stop and netzilo service restart always log the device out and reset its keys. An SSO device then needs the person at the device to sign in; a setup-key device needs netzilo up --setup-key <KEY> again. To re-sync without logging out, use netzilo refresh.

Are clients upgraded when the server is upgraded?

No. Upgrading a self-hosted server does not upgrade the clients, and the client's in-app update notice may not appear. Roll out new client versions with your device management, or from the Add Peer dialog. See Install Netzilo.

What are the anonymous usage statistics?

A self-hosted management server periodically sends Netzilo anonymous usage counts. Only self-hosted servers send them.

What is sent: counts only. Server uptime and version; the number of accounts, users, service users and tokens; the number of peers and how many were active in the last day; how many have SSH or login expiration enabled; the number of groups, policies, routes, DNS servers, posture checks and setup keys; the lowest and highest client versions in use; and which identity provider and database engine the server uses.

What is not sent: names, e-mail addresses, IP addresses, keys, policy contents, device information or AI events.

Turn it off: start the management service with --disable-anonymous-metrics=true. The server logs when it sends and when the next send is due, so you can confirm that it stopped.