Firewall and Network Requirements for Splashtop On-Prem

Overview

Splashtop On-Prem is a self-hosted remote access solution. Unlike Splashtop's cloud-based products, all session traffic flows through your own Splashtop Gateway server — no external Splashtop cloud relay infrastructure is involved during remote sessions. This means your firewall configuration is centered on allowing traffic to and from the Gateway itself, rather than permitting access to third-party domains.

This article applies to all Splashtop On-Prem deployments, including Sovereign Cloud (private cloud) instances, as they share the same Gateway architecture and network requirements.

Note: If you are using Splashtop's cloud-based products (Splashtop Business, Splashtop Enterprise, etc.), please refer to What Are the Firewall Exceptions and IP Addresses of Splashtop Servers/Services? instead.

Quick Reference

Everything below expands on these three rules.

Gateway Port (Firewall Rule Required)

Only one TCP port needs to be open through your network firewall for Splashtop On-Prem to function:

This single port carries all traffic: client authentication, session relay, web console access, and Streamer registration.

Configurable: The default port 443 can be changed to a different port via the Gateway web console under System → Network → Change Port. If you change it, ensure the new port is permitted in your firewall rules and is not occupied by another service. All Streamers and client apps must then specify the new port (e.g., https://gateway-ip:8443).

Endpoint Requirements (Streamer, Client, and SOS Apps)

A common question is which port needs to be opened on the Streamer or client side. There is no separate Streamer port or client port. Endpoints always initiate the connection outbound to the Gateway, on the same port the Gateway is configured with.

Key points for endpoint firewall configuration:

• No inbound firewall rules are required on endpoint machines. Streamer registration, session relay, and remote session traffic all travel over the outbound connection the endpoint establishes to the Gateway.
• Endpoints do not require Internet access. They only require a network route to the Gateway. If the Gateway is reachable only on the internal LAN, endpoints outside that LAN will need the Gateway published externally — see "Making the Gateway Accessible Across Networks" below.
• Streamer and client app updates are downloaded from the Gateway, over the same connection. No outbound access to external update servers is needed.
• If endpoints connect through a proxy, configure the proxy in the app itself rather than opening additional ports. See How do I set up Proxy settings in Splashtop Win/Mac Streamer & Win client?

Internal Ports (Gateway Server, Loopback Only)

The following ports are used internally by the Gateway server for inter-process communication. They do not require any inbound or outbound firewall rules, but they must not be occupied by other applications running on the same machine:

Making the Gateway Accessible Across Networks

If your Streamers or client apps need to reach the Gateway from outside the LAN (e.g., remote workers over the Internet), you must ensure the Gateway has a reachable address. Common approaches include:

• Public IP assigned directly to the Gateway server.
• Port forwarding on your edge firewall or router — forward the external port to the Gateway's internal IP and port.
• DMZ deployment with dual network interfaces — one facing the internal LAN, one facing the Internet.
• FQDN mapping — map a domain name to the Gateway's public IP for convenience and SSL certificate compatibility.

For detailed deployment guidance, refer to How to Make Splashtop Gateway Accessible from the Internet.

URL Path Prefixes (For Web Application Firewalls or Reverse Proxies)

If your environment routes traffic through a Web Application Firewall (WAF) or reverse proxy that inspects or filters by URL path, the following path prefixes on the Gateway must be permitted:

If you are not using a WAF or path-based filtering, these prefixes are served automatically through the Gateway's single service port and no additional configuration is needed.

Reverse proxies and WebSocket support: Gateway relies on WebSocket connections. If your proxy or security layer terminates or downgrades them, sessions may fail to establish. See WebSocket Connections: Enhancing Splashtop Gateway Behind Modern Security Layers.

Outbound Internet Access

Splashtop On-Prem does not require Internet access for remote session traffic or software updates — updates for Streamers and client apps are hosted and distributed through the Gateway itself.

However, outbound Internet access is required on the Gateway for license validation depending on your license type:

• Online license — the Gateway must be able to reach Splashtop's licensing servers on an ongoing basis to validate your license. Allow outbound traffic to *.splashtop.com on port 443.
• Offline license — the Gateway does not require Internet access after activation. This option is available for environments that must remain fully air-gapped. Contact Splashtop support for offline license activation.

This requirement applies to the Gateway only. Streamers and client apps never contact Splashtop servers directly.

Verifying Connectivity

Splashtop On-Prem connectivity can be verified by simply accessing the Gateway web console from the endpoint device. Run this test from a Streamer machine or a client machine — whichever is having trouble connecting — rather than from the Gateway itself.

1. Open a browser on the device in question.
2. Navigate to https://<gateway-address>:<port> (e.g., https://192.168.1.100 or https://gateway.company.com).
3. If the Gateway login page loads, the network path is clear.
4. If the page does not load, check that the Gateway's port is permitted in the firewall and that the correct IP/FQDN and port are being used.

You can also test from the command line:

# Windows PowerShell
Test-NetConnection -ComputerName <gateway-address> -Port 443

# macOS / Linux
curl -Ik https://<gateway-address>:<port>

Summary

For a Splashtop On-Prem deployment, the minimum firewall requirements are:

On the Gateway server:

• Allow TCP port 443 (or your configured port) inbound and outbound to/from the Gateway server's IP address.
• Ensure loopback ports 9080, 5432, 7080, 7081, and 5080 are not occupied on the Gateway machine.
• Allow outbound traffic to *.splashtop.com on port 443 for online license validation. (Not required for offline licenses.)

On Streamer, client, and SOS endpoints:

• Allow outbound TCP 443 (or your configured port) to the Gateway's IP or FQDN.
• No inbound firewall rules are required.
• Allow inbound TCP 6783 from the local network only if you use LAN direct connections.