Identity gateway ports, firewall and sizing

This page tells your network and server teams what to open for each role of the SSOGEN Gateway software, and what to plan for memory and disk. The installer never changes a firewall rule: you open the ports yourself, on the host firewall and on any network device in the path.

The examples use the fictional company Acme Corp with SSOGEN at https://sso.acme.example and a gateway on gw01.acme.example.

1. The short answer

Role on the server	Inbound: open this	Outbound: allow this
Gateway (App Proxy)	The Gateway port, 9943/tcp unless you chose another. Also 9946/tcp when Outbound Connectors dial this Gateway.	SSOGEN (HTTPS), your applications, DNS.
Directory Connector	9945/tcp, from the SSOGEN server only.	SSOGEN (HTTPS), your directory.
Outbound Connector	Nothing.	SSOGEN (HTTPS), its Gateway’s tunnel port 9946/tcp, the applications it reaches.
Relay	443/tcp and 9946/tcp when it serves 443; 9946/tcp alone when it does not.	SSOGEN (HTTPS).
Every role	Never the admin port.

The Gateway software does not listen on a port below 1024. The one exception is a relay that you install to serve 443.

2. Every port, in detail

Port	What it is	Who connects	How to choose it	Exposure
9943/tcp (default)	The Gateway listener	Your users’ browsers, or the load balancer in front of the Gateway	`install-edge.sh --listen-port PORT` at install time	Open it to your users. A listener an administrator publishes in the Admin Console may use another port; open that port before you publish the listener.
127.0.0.1:9942 (default)	The admin and health listener	The `ssogen-edge-diagnostics` program on the same server	`install-edge.sh --admin-port PORT`	Local only. Never open it in the firewall.
The port of SSOGEN’s address (443, or the port the address names)	Gateway to SSOGEN, over HTTPS with certificates on both sides	The Gateway software	Follows `platformOrigin` in `edge.yaml`	Outbound only.
Your applications’ ports	Gateway to each application, as its route names it	The Gateway	Set on each route in the Admin Console	Outbound only.
9945/tcp	The Directory Connector listener	SSOGEN only	`directoryApi.listen` in `edge.yaml`	Let the SSOGEN server reach it and no one else.
9946/tcp	The tunnel port. On a Gateway, the Outbound Connectors dial it. On a relay, Gateways and browsers do.	Outbound Connectors, or the users of a relay		Open it only on a Gateway that has Outbound Connectors, and on a relay.
443/tcp	A relay’s port for browsers and tunnels, when you chose 443	Browsers and Gateways	`--relay-port-443` at install time	Open it on a relay only.

A relay also has a local admin address for its own commands. Like the admin port above, it answers on the server itself only and is never opened in the firewall.

Ports are between 1024 and 65535, and the Gateway port and the admin port must differ.

3. Open the ports

On a server with firewalld, for a Gateway on the default port:

sudo firewall-cmd --permanent --add-port=9943/tcp
sudo firewall-cmd --reload

For a Gateway that has Outbound Connectors, or for a relay, add the tunnel port:

sudo firewall-cmd --permanent --add-port=9946/tcp
sudo firewall-cmd --reload

The installer prints the firewall lines for the roles you chose. Remember the same ports on the network firewall and on any cloud security group in the path.

Use other ports

Choose the ports when you install, for example:

sudo ./install-edge.sh --plan --listen-port 9444 --admin-port 9445

To change them later, run sudo ./install-edge.sh --apply --listen-port PORT --admin-port PORT again from the unpacked archive, then:

sudo systemctl daemon-reload
sudo systemctl restart ssogen-edge

The installer keeps your choice across upgrades, and ssogen-edge-diagnostics finds the admin port by itself. Move the firewall rule with the port.

SELinux

Keep SELinux enforcing. --apply labels the ports the Gateway software itself uses. You add a label only for these:

Case	Command (as root)
An application on a port that is not a usual web port (80, 443, 8443, 8080 and the like need nothing)	`semanage port -a -t ssogen_edge_backend_port_t -p tcp <backend-port>`
Each RDP port a Remote Access resource uses	`semanage port -a -t ssogen_edge_remote_port_t -p tcp 3389`
An SSH target on a port other than 22, or a VNC target outside 5900 to 5983 and 5985 to 5999	The same command with that port and `ssogen_edge_remote_port_t`
SSOGEN’s address or your outbound proxy uses a port other than 443 or 8443	Run `sudo ./install-edge.sh --apply` once more after you write `edge.yaml`

semanage is in the package policycoreutils-python-utils.

4. Outbound-only options

Three arrangements need no inbound port in the network they protect.

You want	Use	What dials out
To reach applications in a network the Gateway cannot connect to	An Outbound Connector inside that network	The connector dials the Gateway’s tunnel port (9946/tcp) and SSOGEN. Its own server opens nothing inbound.
To let people on the internet reach a Gateway inside a private network	A relay	The Gateway dials the relay (443 and 9946) and SSOGEN. Its network opens nothing inbound.
Both	A relay in front of the Gateway and connectors behind it	Each side dials out.

Outbound proxy. If the server may reach the internet only through a proxy, set outboundProxy in edge.yaml in the form http://host:port. It must be a proxy that supports HTTP CONNECT. The Gateway software uses it only for SSOGEN’s address and for relay addresses, never for your applications.

What the outbound allowlist must contain

Destination	Port	Needed by
SSOGEN’s address, for example `sso.acme.example`	443, or the port the address names	Every role
The Gateway’s connector address, for example `gateway.acme.example`	9946	Outbound Connector
The relay’s address	443 and 9946	A Gateway behind a relay
Each application or host	The port its route or resource names	Gateway, or the connector that reaches it
Your DNS servers	DNS	Every role
Your directory and Kerberos servers, when you use those features	LDAPS; Kerberos on TCP 88	The server that runs the feature

On the Gateway server, the name of SSOGEN’s address must not resolve to a local (127.x), link-local or cloud metadata address.

5. Sizing

SSOGEN publishes the figures below. For processor count and for the number of web users one instance carries, ask your SSOGEN contact, giving your expected number of users and applications.

Memory

Figure	Value
Memory ceiling of the service as installed	8 GiB (`MemoryMax=8G`), no swap
Reserved for the gateway itself within that ceiling	2 GiB
Memory ceiling of one Remote Access desktop session	1.5 GiB
Desktop sessions at once with the installed ceiling	4
Each further desktop session at once	1.5 GiB more ceiling

A desktop session that would not fit is refused with the reason capacity before the target is contacted; running sessions are not disturbed. With a ceiling of 2 GiB or less, no desktop session is admitted.

To allow more desktop sessions, raise the ceiling on a server that has the memory:

sudo systemctl edit ssogen-edge

Enter, for example for eight sessions at once (2 GiB plus 8 times 1.5 GiB):

[Service]
MemoryMax=14G

Then restart the service. Web applications behind the App Proxy do not use these session ceilings.

Disk

Figure	Value
Files staged for RDP file transfer, all sessions together	At most 8 GiB on disk
Files staged by one session	At most 1 GiB
When `/tmp` is memory-backed (tmpfs)	Staging stays in memory: 64 MiB a session, 512 MiB in all; a larger upload is refused

Give the server a disk-backed /tmp if people transfer large files over RDP.

Connections and limits

Figure	Value
Tunnel connections an Outbound Connector holds to each live Gateway instance	2
Streams on one tunnel connection	Up to 1,024
Idle time after which a pass-through stream is closed	15 minutes
Time to notice a dead tunnel path	About 45 seconds
Connector addresses on one Gateway group	Up to 8
Gateway enrollments in one organization	Up to 256

Availability

A Gateway group with two or more instances behind a load balancer stays reachable while one instance restarts or is upgraded: every instance of a group receives the same configuration, and you take them out one at a time. See Upgrade an SSOGEN Gateway.