Network and firewall

The heimnull container uses the host’s network directly: it sees your routers’ real source addresses, and its BGP speaker uses port 179 on the server’s own addresses. Docker doesn’t publish or firewall these ports for you, so filter them with the host’s firewall (nftables, ufw or your network’s firewall).

Inbound

Port	For	Allow from
TCP 80	The web interface and API (HN_HTTP_PORT). Plain HTTP; see HTTPS	Your operators. Behind a reverse proxy: the proxy only
UDP 2055	NetFlow v9 (HN_NETFLOW_PORT)	Your routers only
UDP 4739	IPFIX (HN_IPFIX_PORT)	Your routers only
UDP 6343	sFlow v5 (HN_SFLOW_PORT; 0 turns it off)	Your routers only
TCP 179	BGP, only once a local AS is set on the BGP page	Your BGP peers only
UDP 5514	Firewall session logs (HN_SESSIONLOG_PORT), only while an exporter has “NAT from session logs” on	That firewall only

• Every flow port accepts every format. A router sending IPFIX to 2055 works; the ports are only defaults.
• Nothing else listens on the server’s public addresses. PostgreSQL (5432) and ClickHouse (9000, 8123) are bound to 127.0.0.1.
• BGP sessions can be opened from either side, so allow TCP 179 both ways between Heimnull and its peers.
• The web port is plain HTTP. Put a TLS reverse proxy in front of it for anything beyond a trusted management network, and firewall the port to the proxy. Until the first admin account exists, anyone who reaches the page can create it.

Outbound

All outbound traffic is HTTPS (TCP 443), plus DNS.

Destination	For	Needed
registry.heimnull.com	The Heimnull image, docker-compose.yml, and the update check (releases.json, every 6 hours)	Yes
license.heimnull.com	License check-ins, or the installation’s report when it has no key, every 4 hours. See Licensing	Yes
Docker Hub (registry-1.docker.io, auth.docker.io, production.cloudflare.docker.com)	The PostgreSQL and ClickHouse images, at install and upgrade	Yes, or a mirror
api.notoolkit.com	Routed prefixes and origin ASes (every 6 hours), and on-demand WHOIS, registrant and RPKI lookups	Recommended
Dataset publishers	ASN names, geolocation, and the address ranges of cloud and online services. See below	Recommended
Your DNS resolver	Reverse DNS names for the busiest remote addresses, through the host’s resolver	Recommended
Your mail server, chat services, webhooks	Notifications, as you configure them	As configured

The image bundles a copy of every dataset, so a new server works before its first download, and a dataset that can’t be refreshed keeps its last good copy. System → Datasets shows when each was last refreshed. The publishers include:

• iptoasn.com and www.peeringdb.com: AS names, registration countries and peering policies;
• download.db-ip.com: IP geolocation (DB-IP Lite, monthly);
• ip-ranges.amazonaws.com, www.gstatic.com, download.microsoft.com, www.cloudflare.com, api.fastly.com, docs.oracle.com, api.github.com, digitalocean.com: cloud provider address ranges;
• endpoints.office.com, assets.zoom.us, api.steampowered.com, core.telegram.org, login.tailscale.com, ip-ranges.atlassian.com, config.zscaler.com, api.mullvad.net and others: service address lists used to name applications.

We recommend allowing outbound HTTPS in general, rather than to a list, since publishers move their files.

What NoToolkit is sent

On-demand lookups send only remote addresses and AS numbers: an address inside your networks, or in private, shared, loopback, link-local or multicast space, is never sent. Turn them off under Settings → Ingest and lookups (“On-demand lookups”); the pages then show only the offline data.

Without internet access

Setting HN_DATASETS_OFFLINE=1 in .env stops every dataset download and the update check; Heimnull then uses the copies bundled in its image. It still needs license.heimnull.com to keep a license key active (see License states), and access to its registries to upgrade.