---
title: "Ports"
description: "The following tables describe network ports that must be opened to ensure proper communication of Veeam Agent operating in the standalone mode with other backup infrastructure components."
canonical: "https://helpcenter.veeam.com/docs/agentforlinux/userguide/used_ports.html"
breadcrumb: "User Guide > Planning and Preparation > Ports"
dateModified: "2026-11-02"
---

# Ports

The following tables describe network ports that must be opened to ensure proper communication of Veeam Agent operating in the standalone mode with other backup infrastructure components.

To learn about the ports required to enable proper work of Veeam Agent for Linux managed by Veeam Backup & Replication, see [Ports](https://helpcenter.veeam.com/docs/vbr/userguide/agents_used_ports.html?ver=13) in the Veeam Backup & Replication User Guide.

::: important

The list of ports required for computers booted from the Veeam Recovery Media is the same as the list of ports required for Veeam Agent computers.

:::

## Communication with Veeam Backup Servers

To ensure proper communication between Veeam Agent for Linux and Veeam backup server, you must allow network traffic for the following ports:

<table style="width:100%;" class="Blue_Table">
  <tr style="vertical-align:top">
    <th style="width:15%;">
      <p>From</p>
    </th>
    <th style="width:15%;">
      <p>To</p>
    </th>
    <th style="width:9%;">
      <p>Protocol</p>
    </th>
    <th style="width:15%;">
      <p>Port</p>
    </th>
    <th style="width:40%;">
      <p>Notes</p>
    </th>
  </tr>
  <tr style="vertical-align:top">
    <td rowspan="4">
      <p>Veeam Agent computer</p>
    </td>
    <td rowspan="3">
      <p>Veeam backup server</p>
    </td>
    <td style="width:9%;">
      <p>TCP</p>
    </td>
    <td style="width:15%;">
      <p>10006</p>
    </td>
    <td style="width:40%;">
      <p>Default port used for communication with the Veeam backup server.</p>
      <p>Data between the Veeam Agent computer and backup repositories is transferred directly, bypassing Veeam backup servers.</p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td style="width:9%;">
      <p>TCP</p>
    </td>
    <td style="width:15%;">
      <p>443</p>
    </td>
    <td style="width:40%;">
      <p>This port is used by Veeam Agent to obtain authentication tokens from the Veeam Backup Identity Service.</p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td style="width:9%;">
      <p>TCP</p>
    </td>
    <td style="width:15%;">
      <p>445</p>
    </td>
    <td style="width:40%;">
      <p>If Kerberos authentication is disabled in the domain, this port is required for authenticating to a Windows-based Veeam backup server using the legacy NTLM protocol.</p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p>Active Directory Domain Controller</p>
    </td>
    <td style="width:9%;">
      <p>TCP</p>
    </td>
    <td style="width:15%;">
      <p>88</p>
    </td>
    <td style="width:40%;">
      <p>If Kerberos authentication is enabled in the domain, this port is used to obtain a Kerberos ticket from the Active Directory domain controller when authenticating to a Veeam backup server.</p>
      <p>For more information about Kerberos authentication, see <a href="https://helpcenter.veeam.com/docs/vbr/userguide/kerberos_authentication.html?ver=13" target="_blank">Kerberos Authentication</a> in the Veeam Backup & Replication User Guide.</p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p>Veeam backup server</p>
    </td>
    <td>
      <p>Veeam Agent computer</p>
    </td>
    <td style="width:9%;">
      <p>TCP</p>
    </td>
    <td style="width:15%;">
      <p>2500 to 3300, 22</p>
    </td>
    <td style="width:40%;">
      <p>Ports used by Veeam backup server to perform <a href="integration_flr.md">file-level restore launched from Veeam Backup & Replication</a>.</p>
    </td>
  </tr>
</table>

## Communication with Veeam Backup & Replication Repositories

To ensure proper communication between Veeam Agent for Linux and Veeam backup repositories, you must allow outgoing network traffic for the following ports:

<table style="width:100%;" class="Blue_Table">
  <tr style="vertical-align:top">
    <th style="width:183px;">
      <p>From</p>
    </th>
    <th style="width:12%;">
      <p>To</p>
    </th>
    <th style="width:11%;">
      <p>Protocol</p>
    </th>
    <th style="width:15%;">
      <p>Port</p>
    </th>
    <th style="width:40%;">
      <p>Notes</p>
    </th>
  </tr>
  <tr style="vertical-align:top">
    <td rowspan="4" style="width:183px;">
      <p>Veeam Agent computer</p>
    </td>
    <td style="width:12%;">
      <p>Linux or Microsoft Windows server acting as a backup repository</p>
    </td>
    <td style="width:11%;">
      <p>TCP</p>
    </td>
    <td style="width:15%;">
      <p>6162, 2500 to 3300</p>
    </td>
    <td style="width:40%;">
      <p>Default ports used as data transmission channels.
</p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td style="width:12%;">
      <p>Shared folder SMB (CIFS) share</p>
    </td>
    <td style="width:11%;">
      <p>TCP<br/>UDP</p>
    </td>
    <td style="width:15%;">
      <p>445, 139, <br/>137, 138</p>
    </td>
    <td style="width:40%;">
      <p>Ports used as a data transmission channel from the Veeam Agent for Linux computer to the target SMB (CIFS) share.</p>
      <p>Ports 137 to 139 are used by backup infrastructure components to communicate using NetBIOS.</p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td style="width:12%;">
      <p>Active Directory Domain Controller</p>
    </td>
    <td style="width:11%;">
      <p>TCP</p>
    </td>
    <td style="width:15%;">
      <p>88</p>
    </td>
    <td style="width:40%;">
      <p>If Kerberos authentication is enabled in the domain, this port is used to obtain a Kerberos ticket from the Active Directory domain controller when authenticating to a server with a shared folder that functions as a backup repository.</p>
      <p>For more information about Kerberos authentication, see <a href="https://helpcenter.veeam.com/docs/vbr/userguide/kerberos_authentication.html?ver=13" target="_blank">Kerberos Authentication</a> in the Veeam Backup & Replication User Guide.</p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td style="width:12%;">
      <p>Shared folder NFS share</p>
    </td>
    <td style="width:11%;">
      <p>TCP<br/>UDP</p>
    </td>
    <td style="width:15%;">
      <p>111, <br/>2049</p>
    </td>
    <td style="width:40%;">
      <p>Standard NFS ports used as a data transmission channel from the Veeam Agent for Linux computer to the target NFS share.</p>
    </td>
  </tr>
</table>

## Communication with Veeam Cloud Connect Repositories

To ensure proper communication between Veeam Agent for Linux and Veeam Cloud Connect repositories you must allow outgoing network traffic for the following ports:

<table style="width:100%;" class="Blue_Table">
  <tr style="vertical-align:top">
    <th>
      <p>From</p>
    </th>
    <th style="width:15%;">
      <p>To</p>
    </th>
    <th style="width:15%;">
      <p>Protocol</p>
    </th>
    <th style="width:15%;">
      <p>Port</p>
    </th>
    <th style="width:40%;">
      <p>Notes</p>
    </th>
  </tr>
  <tr style="vertical-align:top">
    <td rowspan="2">
      <p>Veeam Agent computer</p>
    </td>
    <td style="width:15%;">
      <p>Cloud gateway</p>
    </td>
    <td style="width:15%;">
      <p>TCP</p>
    </td>
    <td style="width:15%;">
      <p>6180</p>
    </td>
    <td style="width:40%;">
      <p>Port on the cloud gateway used to transport Veeam Agent data to the Veeam Cloud Connect repository.</p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p>Certificate Revocation Lists</p>
    </td>
    <td style="width:15%;">
      <p>TCP</p>
    </td>
    <td style="width:15%;">
      <p>80 or 443</p>
    </td>
    <td style="width:40%;">
      <p>Veeam Agent computer needs access to Certificate Revocation Lists (CRLs) of the Certification Authority (CA) who issued a certificate to the Veeam Cloud Connect service provider.</p>
      <p>Information about certificate verification endpoints (CRL and OCSP server URLs) can be found on the CA website. Certificate verification endpoints are subject to change. The actual list of addresses can be found in the certificate itself.</p>
    </td>
  </tr>
</table>

## Communication with Object Storage

The following table describes network ports that must be opened to ensure proper communication with object storage if you back up data to object storage directly or to object storage added as a Veeam backup repository with the direct connection mode. For more information about object storage connection modes, see [Types of Connection to Object Storage in Veeam Backup & Replication](backup_external_cloud.md#connect).

<table style="width:100%;" class="Blue_Table">
  <tr style="vertical-align:top">
    <th style="width:15%;">
      <p>From</p>
    </th>
    <th style="width:15%;">
      <p>To</p>
    </th>
    <th style="width:15%;">
      <p>Protocol</p>
    </th>
    <th style="width:15%;">
      <p>Port</p>
    </th>
    <th>
      <p>Notes</p>
    </th>
  </tr>
  <tr style="vertical-align:top">
    <td rowspan="9">
      <p>Veeam Agent computer</p>
    </td>
    <td rowspan="2">
      <p>Amazon S3 object storage</p>
    </td>
    <td rowspan="2">
      <p>TCP</p>
    </td>
    <td>
      <p>443</p>
    </td>
    <td>
      <p>Used to communicate with the Amazon S3 object storage through the following endpoints:</p>
      <ul>
        <li class="Table_List"><span class="T_Filenames">*.amazonaws.com</span> (for both <span style="font-style:italic;">Global</span> and <span class="T_Emphasis">Government</span> regions)</li>
        <li class="Table_List"><span class="T_Filenames">*.amazonaws.com.cn</span> (for <span style="font-style:italic;">China </span>region)</li>
      </ul>
      <p>All AWS service endpoints are specified in the <a href="https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region" target="_blank">AWS documentation</a>.</p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p>80</p>
    </td>
    <td>
      <p>Used to verify the certificate status through the following endpoints:</p>
      <ul>
        <li class="Table_List"><span class="T_Filenames">*.amazontrust.com</span></li>
        <li class="Table_List"><span class="T_Filenames">*.cloudfront.net</span></li>
      </ul>
      <p>Consider that certificate verification endpoints (CRL URLs and OCSP servers) are subject to change. The actual list of addresses can be found in the certificate itself.</p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td rowspan="2">
      <p>Microsoft Azure object storage</p>
    </td>
    <td rowspan="2">
      <p>TCP</p>
    </td>
    <td>
      <p>443</p>
    </td>
    <td>
      <p>Used to communicate with the Microsoft Azure object storage through the following endpoints:</p>
      <ul>
        <li class="Table_List"><span class="T_Filenames">&lt;storage-account&gt;.blob.core.windows.net</span> (for <span style="font-style:italic;">Global</span> region)</li>
        <li class="Table_List"><span class="T_Filenames">&lt;storage-account&gt;.blob.core.chinacloudapi.cn</span> (for <span style="font-style:italic;">China</span> region)</li>
        <li class="Table_List"><span class="T_Filenames">&lt;storage-account&gt;.blob.core.usgovcloudapi.net</span> (for <span style="font-style:italic;">Government</span> region)</li>
      </ul>
      <p>Consider that the &lt;storage-account&gt; part of the address must be replaced with your actual storage account URL that can be found in the Azure management portal.</p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p>80</p>
    </td>
    <td>
      <p>Used to verify the certificate status through the following endpoints:</p>
      <ul>
        <li class="Table_List"><span class="T_Filenames">ocsp.digicert.com</span></li>
        <li class="Table_List"><span class="T_Filenames">oneocsp.microsoft.com</span></li>
      </ul>
      <p>Consider that certificate verification endpoints (CRL URLs and OCSP servers) are subject to change. The actual list of addresses can be found in the certificate itself. For more details, see also <a href="https://learn.microsoft.com/en-us/azure/security/fundamentals/azure-CA-details?tabs=root-and-subordinate-cas-list#certificate-downloads-and-revocation-lists" target="_blank">Microsoft documentation</a>.</p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td rowspan="2">
      <p>Google Cloud storage</p>
    </td>
    <td rowspan="2">
      <p>TCP</p>
    </td>
    <td>
      <p>443</p>
    </td>
    <td>
      <p>Used to communicate with Google Cloud storage through the following endpoints:</p>
      <ul>
        <li class="Table_List"><span class="T_Filenames">storage.googleapis.com</span></li>
      </ul>
      <p>All cloud endpoints are specified in <a href="https://cloud.google.com/storage/docs/request-endpoints" target="_blank">this Google article</a>.</p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p>80</p>
    </td>
    <td>
      <p>Used to verify the certificate status through the following endpoints:</p>
      <ul>
        <li class="Table_List"><span class="T_Filenames">ocsp.pki.goog</span></li>
        <li class="Table_List"><span class="T_Filenames">pki.goog</span></li>
        <li class="Table_List"><span class="T_Filenames">crl.pki.goog</span></li>
      </ul>
      <p>Consider that certificate verification endpoints (CRL URLs and OCSP servers) are subject to change. The actual list of addresses can be found in the certificate itself.</p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td style="width:120px;">
      <p>IBM Cloud object storage</p>
    </td>
    <td>
      <p>TCP</p>
    </td>
    <td>
      <p>Depends on device configuration</p>
    </td>
    <td>
      <p>Used to communicate with IBM Cloud object storage.</p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td style="width:120px;">
      <p>S3 compatible object storage</p>
    </td>
    <td>
      <p>TCP</p>
    </td>
    <td>
      <p>Depends on device configuration</p>
    </td>
    <td>
      <p>Used to communicate with S3 compatible object storage.
</p>
    </td>
  </tr>
</table>

## Communication Between Veeam Agent for Linux Components

To ensure proper communication between Veeam Agent for Linux components, you must allow local traffic for the following ports on the Veeam Agent computer:

<table style="width:100%;" class="Blue_Table">
  <tr style="vertical-align:top">
    <th style="width:9%;">
      <p>Protocol</p>
    </th>
    <th style="width:15%;">
      <p>Port</p>
    </th>
    <th style="width:40%;">
      <p>Notes</p>
    </th>
  </tr>
  <tr style="vertical-align:top">
    <td style="width:9%;">
      <p>TCP</p>
    </td>
    <td style="width:15%;">
      <p>2500 to 3000</p>
    </td>
    <td style="width:40%;">
      <p>Default range of ports used locally on the Veeam Agent computer for communication between Veeam Agent for Linux components during data transmission. For every TCP connection that a backup job uses, one port from this range is assigned.
</p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td style="width:9%;">
      <p>TCP</p>
    </td>
    <td style="width:15%;">
      <p>10808</p>
    </td>
    <td style="width:40%;">
      <p>Port used locally on the Veeam Agent computer for communication via REST API between Veeam Agent components (such as control panel and command line interface) and Veeam Agent for Linux Service.</p>
      <p>Make sure this port is not used by any other application.</p>
    </td>
  </tr>
</table>