Manuals
Network Ports & Firewall for IT
Which ports and firewall rules KLANG:app and KLANG devices need, including KOS updates over the network and Collect Logs.
KLANG:app / KOS 6.0.10+
Finding and mixing KLANG devices only needs UDP. Two functions need more: installing a KOS update from KLANG:app over the network, and Collect Logs. Both use HTTP, and the KOS update also needs a connection from the KLANG device to the computer running KLANG:app. If your firewall only allows the UDP ports, discovery and mixing work, but updates seem to hang and the log file is incomplete.
Ports and directions
| Function | From | To | Protocol and port | Purpose |
|---|---|---|---|---|
| Discovery, connect request | KLANG:app | KLANG devices and other KLANG:apps | UDP 9110, broadcast and unicast | Finds processors, :kontrollers and other KLANG:apps (shown in CONFIG > CONNECT) |
| Discovery replies, remote control | KLANG devices, other KLANG:apps | KLANG:app | UDP 9111 (if taken, the next free port) | Device list, status, meters |
| Discovery, “Here I Am” | KLANG devices, KLANG:apps | All KLANG:apps (subnet broadcast) | UDP 9111, every 90 s | Announces each device, KLANG:app answers with a connect request |
| KOS update, download | KLANG device | Computer running KLANG:app | TCP 9109 | The device downloads the update package from KLANG:app |
| KOS update, upload (fallback) | KLANG:app | KLANG device | TCP 80 (HTTP) | Used only if the download above fails |
| Collect Logs | KLANG:app | KLANG devices | TCP 80 (HTTP) | Downloads each device’s log package |
| Collect Logs | KLANG:app | All devices and KLANG:apps | UDP 9110, broadcast | Asks every device and KLANG:app for its logs |
| Collect Logs | KLANG devices, other KLANG:apps | KLANG:app | UDP 9111, large and fragmented datagrams | Short log and hardware status of each device, logs and presets of other KLANG:apps |
| Web interface, license text | Browser | KLANG device | TCP 80 (HTTP) | http://<device IP>/, http://<device IP>/license |
| Dante | See Audinate’s Dante networking documentation | Audio and Dante control are independent of the ports above |
In short: KLANG uses the ports 9109 to 9111 (TCP 9109, UDP 9110 and 9111) plus TCP 80 to the devices.
What your firewall must allow
On the computer running KLANG:app
- Allow incoming TCP 9109 and incoming UDP 9110 and 9111. The simplest and most robust way is a rule that allows incoming connections for the KLANG:app program: if TCP 9109 is already taken on the computer (for example by a second KLANG:app updating at the same time), KLANG:app uses another free port for that update, and a program rule covers that too.
- Windows: When KLANG:app starts for the first time, Windows asks whether it may communicate on networks. Allow it for the network type you actually use. If the network the KLANG devices are on is classified as Public, the rule for Private networks does not apply, and the update download is blocked without any message. Set that network to Private (
Settings > Network & internet > Ethernet > Network profile type) or allow KLANG:app for Public networks. If your company manages the firewall centrally and does not merge local rules, the prompt never appears: ask IT for an inbound rule for KLANG:app or for the ports above. - macOS: If the firewall is on (
System Settings > Network > Firewall), KLANG:app must be allowed to receive incoming connections (Options...). In addition, KLANG:app needs permission underSystem Settings > Privacy & Security > Local Network. Without it, KLANG:app receives broadcasts but cannot reach devices directly.
Between the computer and the KLANG devices
- Keep the computer and the KLANG devices in the same subnet, with nothing in between that translates addresses (NAT) or requires a proxy. The KLANG device must be able to open a connection back to the computer’s IP address.
- Allow TCP 80 from the computer to the KLANG devices.
- Do not drop fragmented UDP packets. Some firewalls and security features on managed switches discard IP fragments. Discovery still works, but
Collect Logsthen misses the short logs of some devices and the logs of other KLANG:apps. - If the computer has more than one network connection, the rules about overlapping IP ranges in KLANG:app | Device Discovery apply to updates and log collection as well.
