Ports and network
This page is for support and IT staff. The network settings described here are in the settings files of the installation and in the Windows firewall; they have no fields in the interface. On a Linux server, use the firewall of that operating system.
A YTCC server runs all of its services on one computer. Most of them accept connections only from that computer. A few must be reachable from the network, because devices or other systems connect to them. The port numbers and where they are set are in the Port table.
Services that listen on the network
These services accept connections on all network interfaces of the server:
| Service | Who connects to it | Runs |
|---|---|---|
| Live data server (gateway) | The web interface on the server | Always |
| OPC UA server driver | OPC UA clients | Only while such a driver runs in a project |
| MQTT broker driver | Field devices and edge devices that publish to it | Only while such a driver runs |
| SNMP trap receiver | Devices that send traps | Only while an SNMP driver runs; can be bound to one address with the device's trap bind address |
| BACnet/IP driver | BACnet devices answering requests and sending notifications | Only while such a driver runs; can be bound to its local IP address |
| DNP3 driver in listening mode | Outstations that connect to YTCC | Only while such a driver runs; can be bound to its bind address |
The live data server protects itself even though it is on the network. When user login is on in a project, reading values and receiving live updates need a signed-in session. Browser requests that change something, and live update connections, are accepted only from pages served by the server itself; a web page from another address is refused.
The live data server can also accept only listed client addresses or networks, with an [access] section in
config\gateway.toml; the server itself is always accepted. See
Allow only known computers to the live data server.
Services that listen only on the server
The message bus (NATS), the project server, the project bridge, the alarm service and the control port of the process
manager listen only on 127.0.0.1. Other computers cannot reach them. The web interface also listens only on 127.0.0.1
until you open it to the network.
The message bus is for the processes on the server itself. Its address can be changed with nats_bind in
config\manager.toml; leave it unset. If it is set to a network address, YTCC logs a security warning at start.
Open the interface from other computers
By default the interface opens only in a browser on the server itself. To open it from other computers on the network,
create the file config\ui-web.toml in the installation folder:
bind = "0.0.0.0"
allow = ["192.0.2.0/24"]
| Setting | Meaning |
|---|---|
bind | The address the interface listens on: 0.0.0.0 for all network adapters, or the address of one adapter. Without the file, 127.0.0.1. |
allow | The client addresses and networks that may connect, as single addresses or in CIDR notation. Connections from other addresses are closed at once. The server itself is always allowed. With an empty list, every address may connect and YTCC logs a warning. |
An invalid entry, or a network with host bits set such as 192.0.2.5/24, stops the interface from starting. Apply a change
with scada-manager restart ui-web.
Then open the interface port (ui_web, by default 8773) in the firewall for those computers and open
http://192.0.2.10:8773 in a browser on them. Clients need only this port. The interface passes live data, commands and
project requests to the services on the server. Requests from a page of another address are still refused.
Turn on user login in every project before you open the interface to the network; see Security hardening checklist.
Firewall
- Allow incoming connections only to the services in the first table, and only from the devices and computers that use them. A driver port that no driver uses can stay closed.
- The web interface reaches the live data server on the server itself, so in a single-server installation no other computer needs it. Keep its port closed to the network unless a computer needs it.
- Open the web interface port only for the computers in
allow, and only when the interface is opened to the network. - Never open the message bus port to the network.
- Allow outgoing connections from the server to the field devices on the ports their drivers use.
- Keep the server and its clients in a protected network.
The steps are in Security hardening checklist.