---
title: "Rocket Chat Firewall Configuration for Secure Access"
slug: "firewall-configuration"
description: "Learn how to configure firewalls for Rocket Chat. Ensure secure communications, zero-trust security, and reliable collaboration across cloud or on-prem deployments."
updated: 2026-05-18T20:48:31Z
published: 2026-05-18T21:38:33Z
canonical: "docs.rocket.chat/firewall-configuration"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rocket.chat/llms.txt
> Use this file to discover all available pages before exploring further.

# Firewall Configuration

If your server is running behind a firewall, you may need to configure it to allow traffic on the ports and domains that Rocket.Chat requires. This page covers port access and the URLs that must be whitelisted for Rocket.Chat Cloud services to function correctly.

## Allow traffic on port 3000

If you are using `firewalld`, run the following commands to allow traffic on Rocket.Chat's default port:

```bash
sudo firewall-cmd --permanent --add-port=3000/tcp
sudo systemctl reload firewalld
```

After reloading the firewall configuration, Rocket.Chat can accept incoming connections on port 3000.

---

## Whitelisting Rocket.Chat Cloud URLs

To enable integration with Rocket.Chat Cloud services, your firewall or network security configuration must allow outbound access to specific Rocket.Chat domains. The required domains depend on the services and features enabled in your workspace.

| URL | Purpose |
| --- | --- |
| `cloud.rocket.chat` | Required for workspace registration, client authentication, license synchronization, and cloud communications. |
| `marketplace.rocket.chat` | List and install [marketplace apps.](https://docs.rocket.chat/docs/rocketchat-marketplace) |
| `releases.rocket.chat` | Check for new Rocket.Chat versions. |
| `billing.rocket.chat` | Handles subscription management and billing operations |
| `gateway.rocket.chat` | Used by Rocket.Chat servers to send mobile push notifications through Rocket.Chat Cloud. The mobile apps themselves connect only to Apple/Google push services. |
| `omni-gateway.rocket.chat` | Gateway for [omnichannel apps](https://docs.rocket.chat/docs/omnichannel-apps) (e.g., WhatsApp, Facebook, Instagram, Telegram). |
| `collector.rocket.chat` | Collects usage statistics. Community workspaces must allow access to this service or the workspace enters read-only mode. |
| `nps.rocket.chat` | NPS (Net Promoter Score) collector. |

Workspaces running in air-gapped or restricted network environments require a [premium plan](/v1/docs/our-plans). If outbound connections to Rocket.Chat Cloud services are blocked, some features above may be unavailable.