> ## Documentation Index > Fetch the complete documentation index at: https://docs.guardway.ai/llms.txt > Use this file to discover all available pages before exploring further. # Network Requirements > The hosts and ports to allow for a self-hosted gateway, the SaaS Gateway and the Guardway endpoint agent. ## What this is for What to allow on your firewall for Guardway. Use the table for each part you run. Every connection is opened from your side; Guardway never connects into your network. Allow hosts by name, because Guardway's hosts have no fixed IP addresses. ## Self-hosted gateway You run the gateway on your own host. Allow these on the **gateway host**: | Host | Port | Direction | Why | | - | - | - | - | | `api.us.guardway.ai` | 443 | Outbound | Control plane: registration, heartbeat and config sync | | `logs.us.guardway.ai` | 443 | Outbound | Event upload | | `id.guardway.ai` | 443 | Outbound | Keys that verify dashboard sign-ins | | `registry.us.guardway.ai` | 443 | Outbound | Guardway images, on install and upgrade | | `563763293556.dkr.ecr.us-east-1.amazonaws.com` | 443 | Outbound | Base images (database, cache). Docker Compose installs only. | | `prod-us-east-1-starport-layer-bucket.s3.us-east-1.amazonaws.com` | 443 | Outbound | Image layer downloads, on install and upgrade | | Your LLM providers and integrations | 443 | Outbound | Model traffic, and the SIEM, alerts, webhooks and MCP servers you configure | | Your applications | 8080 | Inbound | The gateway API. Allow it from your own networks only. | * Nothing needs to reach the gateway from the internet or from Guardway. The dashboard reaches it through the control plane. * Gateways installed before the regional hosts use `api.guardway.ai` and `logs.guardway.ai` instead. Your bundle's `.env` shows which. * The bundle publishes Postgres on port 5432 on all interfaces. Block it from outside the host. * Give the host direct outbound HTTPS (a forward proxy isn't supported) and exempt the Guardway hosts from TLS inspection. * Prompts go from your host straight to your providers. Guardway Cloud receives request metadata, guardrail events with a short redacted preview, and the text checked by Cloud-managed PII detection and Content moderation. Details are on [Environment](/guardway-gateway/environment). ## SaaS Gateway Guardway runs the [SaaS Gateway](/guardway-gateway/saas/overview) for you, so none of the self-hosted rules apply. | Host or address | Port | Direction | Why | | - | - | - | - | | `gateway.guardway.ai` | 443 | Outbound, from your applications | The endpoint your applications call | | `54.210.100.217` | Your service's port | Inbound to your services, optional | The address the SaaS Gateway connects from. Allow it only on model endpoints or MCP servers that accept listed IP addresses. | * Requests pass through Guardway's cloud (United States) on their way to your providers. Request logs are kept for 30 days. * Applications can reach it through a forward proxy. Idle connections close after 30 minutes. ## Endpoint agent The Guardway agent (`gw-cli`) on developer machines. Allow these on **each machine**: | Host | Port | Direction | Why | | - | - | - | - | | `api.us.guardway.ai` | 443 | Outbound | Enrollment, reports, policy and automatic updates | | `9caaea10bd4e26dd2f339e8b5dfc7a97.r2.cloudflarestorage.com` and its subdomains | 443 | Outbound | Agent update downloads | | `gateway.guardway.ai` | 443 | Outbound | SaaS Gateway: model traffic, in Enforce posture only | | Your self-hosted gateway's HTTPS name | 443 | Outbound | Self-hosted gateway: model traffic, in Enforce posture only | | `api.osv.dev` | 443 | Outbound | Package vulnerability lookups during skill scans (off with `--air-gap`) | * A manual `gw-cli upgrade` also needs `api.guardway.ai`. * When an AI provider key (such as `ANTHROPIC_API_KEY` or `OPENAI_API_KEY`) is set on the machine, skill scans also call that provider. Turn this off with `--no-llm` or `--air-gap`. * The agent ignores proxy settings and trusts only public certificate authorities. Give machines direct HTTPS to these hosts and exempt them from TLS inspection. * To enforce through a self-hosted gateway, put it behind an HTTPS load balancer with a public name and a publicly trusted certificate. * The agent's local ports (8788, 8789) listen on `127.0.0.1` only and need no firewall rule. ## Dashboard users Browsers need `app.guardway.ai`, `api.us.guardway.ai`, `id.guardway.ai` and `scan.us.guardway.ai` on port 443. Downloads also need `*.s3.us-east-1.amazonaws.com` (self-hosted gateway bundle) and `9caaea10bd4e26dd2f339e8b5dfc7a97.r2.cloudflarestorage.com` (agent installers). ## Related Hardware and software for a self-hosted gateway. The gateway Guardway runs for you. Posture, gateway and telemetry settings for endpoint agents. What Guardway stores and how it is protected. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.