Relay Server Overview
Dinesh
Last Update 7 days ago
Overview
A Relay Server is used when assets are located in a separate, restricted, or isolated network where the Central Server cannot directly communicate with them.
The Relay Server is deployed inside the customer's network and acts as a communication bridge between the Central Server and the managed assets.
SecOps Solution supports two types of Relay Servers:
- Jump Host
- Distribution Server
Both provide connectivity to assets in restricted networks. A Distribution Server additionally provides a local patch repository for assets within that network.
Note: In this document, Central Server refers to either the SecOps SaaS Platform or the SecOps On-Prem Central Server.
How Relay Communication Works
The communication path depends on how the asset is onboarded.
Agent-based Asset
For an agent-based asset, the agent on the target machine initiates the connection to the Relay Server.
The target machine does not require inbound connectivity from the Relay Server for this communication.
Agentless Asset
For an agentless asset, the Relay Server initiates the connection to the target machine using the required management protocol.
For Windows, the Relay Server uses WinRM.
For Linux, the Relay Server uses SSH.
For Linux, the Relay Server uses SSH.
Jump Host
A Jump Host acts as a Relay Server between the Central Server and assets in a restricted or isolated network.
It provides the required connectivity to manage assets without requiring direct connectivity between the Central Server and each target asset.
Architecture
When should I use a Jump Host?
Use a Jump Host when:
- Assets are located in a restricted or isolated network.
- The Central Server cannot directly reach the assets.
- You need relay connectivity to manage the assets.
- A local patch repository is not required.
Distribution Server
A Distribution Server provides the same relay functionality as a Jump Host, with an additional local patch repository.
The local repository allows patch content to be stored within the network and distributed to assets locally.
Architecture
When should I use a Distribution Server?
Use a Distribution Server when:
- Assets are located in a branch or remote network.
- Multiple assets require patch deployment.
- Network or WAN bandwidth is limited.
- Assets have restricted access to external patch sources.
- You want to maintain patch content locally within the network
Use a Jump Host when you need relay connectivity.
Use a Distribution Server when you need relay connectivity along with local patch distribution.
Hardware Requirements
The minimum hardware requirements for a Relay Server depend on the number of endpoints managed through the server and the server role.
| No. of Clients per Relay Server | Jump Host | Distribution Server |
|---|---|---|
| 1-500 | 2 cores, 4 GB RAM, 10 GB SSD | 2 cores, 4 GB RAM, 50 GB SSD |
| 501–1,000 | 2 cores, 4 GB RAM, 10 GB SSD | 2 cores, 4 GB RAM, 75 GB SSD |
| 1,001–3,000 | 4 cores, 8 GB RAM, 15 GB SSD | 4 cores, 8 GB RAM, 150 GB SSD |
| 3,001–5,000 | 6 cores, 12 GB RAM, 20 GB SSD | 6 cores, 12 GB RAM, 250 GB SSD |
Notes:
- Jump Host: Storage requirements are minimal because it does not maintain a local patch repository.
- Distribution Server: Additional storage is required for the local patch repository. Actual storage consumption may vary depending on the number and type of patches distributed.
- SSD storage is recommended for better performance, particularly for Distribution Servers.
Network and Firewall Requirements
The firewall requirements depend on:
- Communication between the Relay Server and the Central Server.
- Communication between the Relay Server and agent-based assets.
- Communication between the Relay Server and agentless assets.
- Internal communication with the Relay Server.
1. Relay Server to Central Server
The Relay Server must be able to communicate with the Central Server.
SaaS Deployment
For SaaS deployments, the Relay Server requires outbound HTTPS connectivity to the SecOps SaaS Platform.
| Source | Destination | Port | Protocol | Direction |
|---|---|---|---|---|
| Relay Server | SecOps SaaS Platform (api.app.secopsolution.com, socket.app.secopsolution.com) | 443 | HTTPS/WSS | Outbound |
On-Prem Deployment
For On-Prem deployments, the Relay Server communicates with the On-Prem Central Server.
| Source | Destination | Port | Protocol | Direction |
|---|---|---|---|---|
| Relay Server | On-Prem Central Server | 58443 | HTTPS | Outbound |
| Relay Server | On-Prem Central Server | 58080 | HTTP | Outbound |
2. Relay Server Inbound Ports
The Relay Server requires inbound communication from the internal network.
The following ports must be enabled on both Jump Host and Distribution Server:
| Source | Destination | Port | Protocol | Direction |
|---|---|---|---|---|
| Internal Network | Relay Server | 5679 | HTTP | Inbound |
| Internal Network | Relay Server | 5683 | WS/HTTP | Inbound |
| Internal Network | Relay Server | 5683 | WS/HTTP | Inbound |
| Internal Network | Relay Server | 5684 | WSS/HTTPS | Inbound |
Network Flow
Important
Ports 5679 and 5680 should be accessible only from the required internal networks or subnets. For agent-based onboarding through a Relay Server, ports 5683 and 5684 are additionally required for WebSocket connectivity.
They should not be exposed to the Internet or external networks.
The firewall should restrict these ports to the internal source networks that need to communicate with the Relay Server.
3. Agent-Based Asset Communication
For agent-based assets, the agent installed on the target machine initiates communication with the Relay Server.
The target machine requires outbound HTTP/HTTPS connectivity to the Relay Server.
Firewall Requirement
| Source | Destination | Port | Protocol | Direction |
|---|---|---|---|---|
| Agent-based Asset | Relay Server | 5679 | HTTP | Outbound |
| Agent-based Asset | Relay Server | 5683 | WS/HTTP | Outbound |
| Agent-based Asset | Relay Server | 5683 | WS/HTTP | Outbound |
| Agent-based Asset | Relay Server | 5684 | WSS/HTTPS | Outbound |
The corresponding ports 5679, 5680, 5683, and 5684 must be allowed as inbound ports on the Relay Server.
No inbound connection from the Relay Server to the agent-based target machine is required for this communication.
4. Agentless Asset Communication
For agentless assets, the Relay Server directly communicates with the target machine.
The required ports depend on the target operating system.
Windows Assets
The Relay Server communicates with Windows assets using WinRM.
| Source | Destination | Port | Protocol | Direction |
|---|---|---|---|---|
| Relay Server | Windows Asset | 5985 | WinRM / HTTP | Outbound |
| Relay Server | Windows Asset | 5986 | WinRM / HTTPS | Outbound |
Use the port configured on the Windows target.
Linux/Mac Assets
The Relay Server communicates with Linux assets using SSH.
| Source | Destination | Port | Protocol | Direction |
|---|---|---|---|---|
| Relay Server | Linux/Mac Asset | 22* | SSH | Outbound |
*SSH can be configured on a custom port. If a custom SSH port is used, that port must be allowed from the Relay Server and configured during asset onboarding.
Complete Firewall Reference
Use the following table as a quick reference when configuring firewall rules.
| Communication | Source | Destination | Port | Protocol | Direction |
|---|---|---|---|---|---|
| SaaS communication | Relay Server | SecOps SaaS Platform | 443 | HTTPS/WSS | Outbound |
| On-Prem communication | Relay Server | On-Prem Central Server | 58443 | HTTPS/WSS | Outbound |
| On-Prem communication | Relay Server | On-Prem Central Server | 58080 | HTTP | Outbound |
| Agent-based communication | Agent-based Asset | Relay Server | 5679 | HTTP | Outbound |
| Agent-based communication | Agent-based Asset | Relay Server | 5680 | HTTPS | Outbound |
| Agent-based communication | Agent-based Asset | Relay Server | 5683 | WS/HTTP | Outbound |
| Agent-based communication | Agent-based Asset | Relay Server | 5684 | WS/HTTPS | Outbound |
| Agentless Windows | Relay Server | Windows Asset | 5985 | WinRM/HTTP | Outbound |
| Agentless Windows | Relay Server | Windows Asset | 5986 | WinRM/HTTPS | Outbound |
| Agentless Linux/Mac | Relay Server | Linux/Mac Asset | 22* | SSH | Outbound |
Relay Server Inbound
The following ports must be enabled inbound on the Relay Server from the required internal network/subnets:
Do not expose ports 5679, 5680, 5683, and 5684 to the Internet.
Summary
A Relay Server provides a secure communication path between the Central Server and assets located in restricted networks. A Jump Host is used when relay connectivity is required, while a Distribution Server provides the same relay connectivity along with a local patch repository. For SaaS deployments, the Relay Server communicates with the SaaS Platform over 443/TCP, while for On-Prem deployments, it communicates with the Central Server over 58443/58080. For agent-based assets, the target machine initiates HTTP/HTTPS communication to the Relay Server over 5679/5680, while for agentless assets, the Relay Server initiates communication to the target using 5985/5986 for Windows or 22 for Linux by default. Ports 5679/5680/5683/5684 must be allowed inbound on the Relay Server only from the required internal networks and must never be exposed to the Internet.