Who is this Guide For?
- Network administrators who manage the firewall, proxy, or web filtering platform at a site where NinjaOne is deployed
- IT staff troubleshooting devices that show offline, remote sessions that won't connect, or backups that fail
What You'll Accomplish
- Allow the URLs and IP addresses the NinjaOne agent and patcher need
- Allow the endpoints for NinjaOne Remote, Backup, File Explorer, and NMS
- Confirm your firewall policy won't block agent check-ins or remote sessions
Introduction
NinjaOne agents reach their cloud services over outbound HTTPS. If your firewall, proxy, or web filter blocks any of those destinations, devices drop offline, patching stalls, and remote sessions fail to start.
Use the tables below to build your allowlist. Start with the wildcard entries — they cover most of the article. If your firewall doesn't support wildcards, work through the individual URL tables instead.
Prerequisites
- Administrative access to your firewall, proxy, or web filtering platform
- Outbound HTTPS on port 443 permitted from managed devices
- A list of the NinjaOne services you use — Remote, Backup, and NMS each have their own requirements
Recommended Wildcard Allowlist
If your firewall supports wildcard entries, allow these two URLs. They cover the NinjaOne agent and patcher services, File Explorer rendezvous points, and WebSocket rendezvous points.
| Purpose | URL |
|---|---|
| Attachments and agent services | https://ninja-attachments.s3.us-west-2.amazonaws.com/* |
| NinjaOne services | https://*.rmmservice.com |
Note: The wildcard entries don't cover NinjaOne Remote, Backup, or NMS. Add those sections separately if you use them.
Core NinjaOne Agent and Patcher Services
If wildcard support isn't available, allow these individual URLs.
| Service | URL |
|---|---|
| Main application | https://app.ninjarmm.com |
| RTC service | https://rtc-us-west-1.ninjarmm.com |
| RTC service | https://rtc-us-west-2.ninjarmm.com |
| Agent tunnel | https://agent-tun-usw-1.ninjarmm.com |
| Agent tunnel | https://agent-tun-usw-2.ninjarmm.com |
| Agent tunnel | https://agent-tun-usw-3.ninjarmm.com |
WebSocket Rendezvous Points
Required for remote communication services.
| URL | Notes |
|---|---|
| https://connect-us-west-s[0–71].ninjarmm.com | [0–71] represents 72 separate database shard endpoints. Allow all of them. |
| https://connect-us-west.ninjarmm.com | Base WebSocket rendezvous endpoint. |
File Explorer Rendezvous Points
Required for File Explorer functionality within NinjaOne.
| URL |
|---|
| https://fts-prod-oregon-1.ninjarmm.com |
| https://fts-prod-oregon-2.ninjarmm.com |
| https://fts-prod-oregon.ninjarmm.com |
| https://fts-prod-ohio.ninjarmm.com |
Required IP Gateways
Allow these IP addresses.
| IP address |
|---|
| 52.33.253.235 |
| 34.212.188.161 |
| 35.163.67.164 |
NinjaOne Remote
Note: NinjaOne Remote moved from dynamic IP load balancing to static routing on March 31, 2026. The addresses below are the current static set, and the older dynamic IPs have been retired. If your allowlist still carries pre-2026 NinjaOne Remote IPs, you can remove them.
If you use NinjaOne Remote, allow these URLs and IP addresses.
| Endpoint | URL | IP addresses |
|---|---|---|
| NC-1 | https://nc-1-us-west-2.ninjarmm.net | 52.34.129.87 52.13.36.180 44.245.136.163 |
| NC-2 | https://nc-2-us-west-2.ninjarmm.net | 35.164.53.200 52.27.27.201 44.232.239.255 |
| NC-3 | https://nc-3-us-west-2.ninjarmm.net | 52.35.89.62 52.37.179.97 44.238.0.90 |
| NC-4 | https://nc-4-us-west-2.ninjarmm.net | 52.33.24.0 44.226.168.60 44.244.183.35 |
| NC-5 | https://nc-5-us-west-2.ninjarmm.net | 35.155.38.70 35.80.122.79 34.214.137.89 |
| NC-6 | https://nc-6-us-west-2.ninjarmm.net | 44.246.7.150 52.13.226.123 54.186.60.125 |
| NC-7 | https://nc-7-us-west-2.ninjarmm.net | 52.34.162.185 44.245.76.34 35.165.85.4 |
| NC-8 | https://nc-8-us-west-2.ninjarmm.net | 44.225.175.196 52.43.69.90 34.213.193.8 |
NinjaOne NMS
Required for the NinjaOne Network Monitoring Services agent.
| Service | URL |
|---|---|
| NMS agent | https://agent-app.ninjarmm.com |
Tips and Warnings
- Use wildcard allowlisting whenever your firewall or web filtering platform supports it. It's fewer entries to maintain when NinjaOne adds infrastructure.
- Allow outbound HTTPS traffic on port 443. Everything in this article is agent-initiated outbound traffic.
- Review your firewall policy on a regular schedule so infrastructure changes don't catch you out.
Warning: If your firewall performs SSL or TLS inspection, exclude these hosts from inspection. Agents pin their connections, and a rewritten certificate breaks check-in even when the destination is allowed.
Troubleshooting
Devices show offline after a firewall change
- Confirm the core agent and patcher URLs are allowed, especially app.ninjarmm.com and the agent-tun endpoints.
- Confirm the WebSocket rendezvous points are allowed. Agents use them to hold their connection open, and blocking a single shard takes a subset of devices offline.
- Check whether SSL or TLS inspection applies to the new rule, and exclude the NinjaOne hosts if it does.
Remote sessions won't connect
- Allow all eight nc-1 through nc-8 URLs and their IP addresses. Sessions are assigned to an endpoint at connect time, so a partial list fails intermittently.
- Remove any pre-2026 NinjaOne Remote IPs still sitting in the allowlist and replace them with the current set.
File Explorer won't open
- Allow the four fts-prod rendezvous points. These are separate from the agent tunnel, so the device can be online and still fail here.
Backups fail but the agent stays online
- Allow the NinjaOne Backup URL for your region. Backup traffic goes to Amazon S3, which many filtering platforms block by default.
FAQ
Do I have to allow all 72 WebSocket shard endpoints?
Yes, unless your firewall supports wildcards. Each endpoint maps to a different database shard, and you can't predict which one a device lands on.
Can I just use the two wildcard entries?
They cover the agent and patcher services, File Explorer, and the WebSocket rendezvous points. NinjaOne Remote, Backup, and NMS still need their own entries.
Which ports do these services use?
Outbound TCP 443. No inbound rules are needed — the agent starts every connection.
Need More Help?
If you need additional assistance, please contact Crexendo Support at 913.599.6900 or email us at support@allegiantnow.com — our team is happy to help!