Network flows and ports¶

Reemo exposes few inbound ports: most flows originate from clients and agents toward the platform. This page summarizes the main flows and ports; the full detail is in the network matrices.

Main flows: the browser and the agent reach the portal and the Signal service; the media flow goes over direct WebRTC (UDP), through a TURN server, or over WebSocket; the appliance only emits outbound flows. — *The main flows between the browser, the agent, the platform, and the relays.*¶

Ports exposed by the platform¶

On the infrastructure side, the main listening ports are:

Portal (users): 443 (HTTPS), via Traefik.
Signal (Reemo agents): 8443 (HTTPS).
WebSocket relay (RELAYWS): 443.
Portal Credential: 8446 (HTTPS, mTLS).

Media flow¶

Once the session is negotiated, the media flow takes one of the following paths:

Direct WebRTC: UDP, range 58200–58400 by default, between the client and the agent.
Relayed WebRTC (TURN): to the TURN server, on port 443 (Reemo relay) or 3478 (for example Cloudflare).
WebSocket (RELAYWS): HTTPS on 443, through a dedicated relay container.

Appliance: outbound-only flows¶

The APPLIANCE environment requires no inbound opening: the connector initiates an outbound connection to the Reemo infrastructure (TCP 8443, 8444, 8446) and to the ancillary services (registry and downloads on 443, TURN on 3478). No inbound flow is required toward the network that hosts the containers.

Internal trust¶

Between micro-services, communications are encrypted with mTLS over an internal PKI. In a cluster, Docker Swarm nodes exchange over an overlay network (UDP 4789).