Self-HostedFirewallNetworking
Self-hosted firewall configuration
The inbound and outbound rules a self-hosted instance needs - control ports, passive ranges, and the cloud configuration link.
Updated August 27, 2026A self-hosted instance runs three listeners in one process:
- FTP + explicit FTPS (default port
2021, or wherever-port21points) - Implicit FTPS (default
9990) - SSH for SFTP and SCP (default
2022)
Inbound rules
Assuming the conventional production mapping
(-port21 21 -port22 22 -port990 990 -passiveports21 2030-2039 -passiveports990 2040-2049), allow inbound TCP:
| Ports | Purpose |
|---|---|
21, 22, 990 | FTP/FTPS, SFTP/SCP, implicit FTPS control connections |
2030-2039 | Passive data ports (FTP + explicit FTPS) |
2040-2049 | Passive data ports (implicit FTPS) |
Match the two ranges to whatever you set -passiveports21 and
-passiveports990 to - and remember the ranges
must not overlap.
If your users only ever use SFTP, port 22 alone is enough - the passive ranges exist for FTP/FTPS.
Outbound rules
The instance needs to reach DocEvent's cloud for configuration:
- HTTPS (443) outbound, including long-lived websocket connections - this is the configuration link described in the overview
- DNS queries
It also needs to reach your storage backend (S3, Azure, GCS endpoints) - also HTTPS 443.