# PPS Documentation **URL:** \ **Category:** Access Points\ **Created:** [August 31, 2024, 2:20pm UTC](https://forum.alta.inc/t/pps-documentation/3142 "2024-08-31T14:20:29Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Joe](https://forum.alta.inc/letter_avatar_proxy/v4/letter/j/b9e5f3/32.png) [@Joe](https://forum.alta.inc/u/Joe)\ **Post date:** [August 31, 2024, 2:20pm UTC](https://forum.alta.inc/t/pps-documentation/3142/1 "2024-08-31T14:20:29Z")
Is there official documentation on the ports, protocols and services (PPS) required through a firewall to allow the access points to communicate with on-prem controllers as well as cloud controllers? ---
**Author:** ![anon77415413](https://forum.alta.inc/letter_avatar_proxy/v4/letter/a/f1d935/32.png) [@anon77415413](https://forum.alta.inc/u/anon77415413)\ **Post date:** [August 31, 2024, 3:04pm UTC](https://forum.alta.inc/t/pps-documentation/3142/2 "2024-08-31T15:04:01Z")
I would like this as well! ---
**Author:** ![Joe](https://forum.alta.inc/letter_avatar_proxy/v4/letter/j/b9e5f3/32.png) [@Joe](https://forum.alta.inc/u/Joe)\ **Post date:** [August 31, 2024, 3:19pm UTC](https://forum.alta.inc/t/pps-documentation/3142/3 "2024-08-31T15:19:44Z")
I can gather them from my Palo but I’d prefer if the team had official documentation. ---
**Author:** ![Alta-Jeff](https://forum.alta.inc/user_avatar/forum.alta.inc/alta-jeff/32/56_2.png) [@Alta-Jeff](https://forum.alta.inc/u/Alta-Jeff)\ **Post date:** [September 1, 2024, 5:39am UTC](https://forum.alta.inc/t/pps-documentation/3142/4 "2024-09-01T05:39:33Z")
Not official, but port 443 to the desired controller (cloud controller is [manage.alta.inc](http://manage.alta.inc)), as well as port 443 for [dl.alta.inc](http://dl.alta.inc) for firmware updates should be the main two hosts and ports you will need. You will always want NTP and DNS open. -Jeff ---
**Author:** ![Joe](https://forum.alta.inc/letter_avatar_proxy/v4/letter/j/b9e5f3/32.png) [@Joe](https://forum.alta.inc/u/Joe)\ **Post date:** [September 1, 2024, 11:54am UTC](https://forum.alta.inc/t/pps-documentation/3142/5 "2024-09-01T11:54:42Z")
So tcp/443, udp/123, tcp/53 and udp/53. ---
**Author:** ![Joe](https://forum.alta.inc/letter_avatar_proxy/v4/letter/j/b9e5f3/32.png) [@Joe](https://forum.alta.inc/u/Joe)\ **Post date:** [September 2, 2024, 10:23am UTC](https://forum.alta.inc/t/pps-documentation/3142/6 "2024-09-02T10:23:55Z")
Seeing a lot more traffic reaching out to end points other than what you’ve listed above. A lot of dns-over-https and the use of DNS servers other than the ones I’ve hardcoded on the access point… ![Screenshot 2024-09-02 at 5.18.37 AM](https://forum.alta.inc/uploads/default/original/2X/9/922ac2193ff1f4ad0b7d47baf4028d5d17956fc1.jpeg) **Last connection on 8/26/2024** ![Screenshot 2024-09-02 at 5.22.24 AM](https://forum.alta.inc/uploads/default/original/2X/c/c29eb8467f0bb9ca0432d20858b12d0638f803e1.jpeg) ![Screenshot 2024-09-02 at 5.18.53 AM](https://forum.alta.inc/uploads/default/original/2X/0/0053b7228ce330d482c9323fc862ed0da344f4b4.png) ![Screenshot 2024-09-02 at 5.19.08 AM](https://forum.alta.inc/uploads/default/original/2X/8/8bdc3c4adcce657037ff3f88cc477af8393b9c99.png) ![Screenshot 2024-09-02 at 5.19.24 AM](https://forum.alta.inc/uploads/default/original/2X/3/3882e18bc07f4ea87f5547a1896139ad4e84e827.png) ---
**Author:** ![carrottspc](https://forum.alta.inc/user_avatar/forum.alta.inc/carrottspc/32/962_2.png) [@carrottspc](https://forum.alta.inc/u/carrottspc)\ **Post date:** [September 2, 2024, 11:03am UTC](https://forum.alta.inc/t/pps-documentation/3142/7 "2024-09-02T11:03:39Z")
You’ll need [ping.alta.inc](http://ping.alta.inc) as well. That’s the 75.2.70.75 address. Every 30 seconds the APs will hit that. ---
**Author:** ![Joe](https://forum.alta.inc/letter_avatar_proxy/v4/letter/j/b9e5f3/32.png) [@Joe](https://forum.alta.inc/u/Joe)\ **Post date:** [September 2, 2024, 1:40pm UTC](https://forum.alta.inc/t/pps-documentation/3142/8 "2024-09-02T13:40:18Z")
Appears DNS servers that have been configured by Alta in /etc/config/https-dns-proxy are being used even after you manually configure your preferred servers in the UI. In my opinion, this shouldn’t happen. Especially DNS over TLS. root@FamilyRoom:/etc/config# cat https-dns-proxy config main ‘config’ option canary\_domains\_icloud ‘1’ option canary\_domains\_mozilla ‘1’ option dnsmasq\_config\_update ‘\*’ option force\_dns ‘0’ list force\_dns\_port ‘53’ list force\_dns\_port ‘853’ **#Items below were commented out. Removed the comment to remove the bold font#** ports listed below are used by some of the dnscrypt-proxy v1 resolvers list force\_dns\_port ‘553’ list force\_dns\_port ‘1443’ list force\_dns\_port ‘4343’ list force\_dns\_port ‘4434’ list force\_dns\_port ‘5443’ list force\_dns\_port ‘8443’ **#Items above were commented out. Removed the comment to remove the bold font#** option procd\_trigger\_wan6 ‘0’ config https-dns-proxy option bootstrap\_dns ‘1.1.1.1,1.0.0.1’ option resolver\_url ‘[https://cloudflare-dns.com/dns-query](https://cloudflare-dns.com/dns-query)’ option listen\_addr ‘127.0.0.1’ option listen\_port ‘5054’ option user ‘nobody’ option group ‘nogroup’ config https-dns-proxy option bootstrap\_dns ‘8.8.8.8,8.8.4.4’ option resolver\_url ‘[https://dns.google/dns-query](https://dns.google/dns-query)’ option listen\_addr ‘127.0.0.1’ option listen\_port ‘5053’ option user ‘nobody’ option group ‘nogroup’ config https-dns-proxy option bootstrap\_dns ‘208.67.222.222,208.67.220.220’ option resolver\_url ‘[https://doh.opendns.com/dns-query](https://doh.opendns.com/dns-query)’ option listen\_addr ‘127.0.0.1’ option listen\_port ‘5055’ option user ‘nobody’ option group ‘nogroup’ root@FamilyRoom:/etc/config# ---
**Author:** ![Joe](https://forum.alta.inc/letter_avatar_proxy/v4/letter/j/b9e5f3/32.png) [@Joe](https://forum.alta.inc/u/Joe)\ **Post date:** [September 2, 2024, 3:32pm UTC](https://forum.alta.inc/t/pps-documentation/3142/9 "2024-09-02T15:32:37Z")
Looks like the following NTP servers are in use. [0.openwrt.pool.ntp.org](http://0.openwrt.pool.ntp.org) [1.openwrt.pool.ntp.org](http://1.openwrt.pool.ntp.org) [2.openwrt.pool.ntp.org](http://2.openwrt.pool.ntp.org) [3.openwrt.pool.ntp.org](http://3.openwrt.pool.ntp.org) **Source Information** system.ntp.enabled=‘1’ system.ntp.enable\_server=‘0’ system.ntp.server=‘[0.openwrt.pool.ntp.org](http://0.openwrt.pool.ntp.org)’ ‘[1.openwrt.pool.ntp.org](http://1.openwrt.pool.ntp.org)’ ‘[2.openwrt.pool.ntp.org](http://2.openwrt.pool.ntp.org)’ ‘[3.openwrt.pool.ntp.org](http://3.openwrt.pool.ntp.org)’ ---
**Author:** ![Alta-Jeff](https://forum.alta.inc/user_avatar/forum.alta.inc/alta-jeff/32/56_2.png) [@Alta-Jeff](https://forum.alta.inc/u/Alta-Jeff)\ **Post date:** [September 2, 2024, 4:01pm UTC](https://forum.alta.inc/t/pps-documentation/3142/10 "2024-09-02T16:01:54Z")
Both DHCP-provided and integrated DOH servers are enabled in parallel on all Alta devices, in order to support local controllers behind networks that have DNS rebinding protection enabled (in general we recommend that this protection be _disabled_). Both are not required to maintain a connection to the cloud; only one is, but it will still use both if possible. Good catch on [ping.alta.inc](http://ping.alta.inc). All of our main web endpoints are AWS CloudFront endpoints, so the IPs will change and be dependent on your geographical location. ---
**Author:** ![Quackers](https://forum.alta.inc/user_avatar/forum.alta.inc/quackers/32/2710_2.png) [@Quackers](https://forum.alta.inc/u/Quackers)\ **Post date:** [November 12, 2024, 12:44pm UTC](https://forum.alta.inc/t/pps-documentation/3142/11 "2024-11-12T12:44:40Z")
Would be useful from a user perspective to have **these displayed in the GUI** and allow user to choose there own. **Not a fan predefined DNS and NTP.** The user ultimatedly should be able to configure key service NTP/DNS. If you hve hardwired services please show these in the GUI , allow user to choose there preffered services. The fact the user is **not aware** of the https proxy is not a good thing, Can’t think of a router apart from ISP locked down one, where NTP and DNS are forced / locked down or hidden from from the user. ---
**Author:** ![Joe](https://forum.alta.inc/letter_avatar_proxy/v4/letter/j/b9e5f3/32.png) [@Joe](https://forum.alta.inc/u/Joe)\ **Post date:** [November 13, 2024, 2:06am UTC](https://forum.alta.inc/t/pps-documentation/3142/12 "2024-11-13T02:06:41Z")
I concur. This is why I blocked anything not 53/udp. I could care less about the NTP traffic but do agree we should be able to configure ones of our choosing. ---
**Author:** ![Alta-Josh](https://forum.alta.inc/user_avatar/forum.alta.inc/alta-josh/32/2466_2.png) [@Alta-Josh](https://forum.alta.inc/u/Alta-Josh)\ **Post date:** [November 13, 2024, 8:24pm UTC](https://forum.alta.inc/t/pps-documentation/3142/13 "2024-11-13T20:24:32Z")
I don’t think I follow – you can configure DNS in the same place you edit the VLAN and subnet. Defaults are provided for convenience. ---
**Author:** ![Quackers](https://forum.alta.inc/user_avatar/forum.alta.inc/quackers/32/2710_2.png) [@Quackers](https://forum.alta.inc/u/Quackers)\ **Post date:** [November 13, 2024, 8:30pm UTC](https://forum.alta.inc/t/pps-documentation/3142/14 "2024-11-13T20:30:38Z")
DNS HTTPS Proxy has hard coded DoT servers I think Cloudflare, google and opendns. NTP= openwrt pool ---
**Author:** ![Joe](https://forum.alta.inc/letter_avatar_proxy/v4/letter/j/b9e5f3/32.png) [@Joe](https://forum.alta.inc/u/Joe)\ **Post date:** [November 13, 2024, 11:41pm UTC](https://forum.alta.inc/t/pps-documentation/3142/15 "2024-11-13T23:41:03Z")
I’m talking about the statically pre-configured information I listed above on September 2nd. ---
**Author:** ![Zan](https://forum.alta.inc/user_avatar/forum.alta.inc/zan/32/1917_2.png) [@Zan](https://forum.alta.inc/u/Zan)\ **Post date:** [January 20, 2025, 9:14am UTC](https://forum.alta.inc/t/pps-documentation/3142/16 "2025-01-20T09:14:17Z")
Any updates on this topic? ---
**Author:** ![Alta-Jeff](https://forum.alta.inc/user_avatar/forum.alta.inc/alta-jeff/32/56_2.png) [@Alta-Jeff](https://forum.alta.inc/u/Alta-Jeff)\ **Post date:** [January 20, 2025, 7:55pm UTC](https://forum.alta.inc/t/pps-documentation/3142/17 "2025-01-20T19:55:06Z")
We could make an official document, but is there anything missing from the above that you’d like on the article? So far we have: Required: TCP Port 443 to the desired controller (cloud controller is [manage.alta.inc](http://manage.alta.inc)) TCP Port 443 for [dl.alta.inc](http://dl.alta.inc) One of these are required for time synchronization: NTP (UDP Port 123) HTTP/HTTPS (to 1.1.1.1, [google.com](http://google.com), or [alta.inc](http://alta.inc)) Optional: HTTPS to CloudFlare/Google/OpenDNS DOH, for DNS-over-HTTPS ---
**Author:** ![Joe](https://forum.alta.inc/letter_avatar_proxy/v4/letter/j/b9e5f3/32.png) [@Joe](https://forum.alta.inc/u/Joe)\ **Post date:** [January 20, 2025, 9:10pm UTC](https://forum.alta.inc/t/pps-documentation/3142/18 "2025-01-20T21:10:41Z")
I think Alta should release an offical document. ---
**Author:** ![Huskion](https://forum.alta.inc/user_avatar/forum.alta.inc/huskion/32/3602_2.png) [@Huskion](https://forum.alta.inc/u/Huskion)\ **Post date:** [February 20, 2025, 3:09pm UTC](https://forum.alta.inc/t/pps-documentation/3142/19 "2025-02-20T15:09:36Z")
Funny to find this thread immediately after searching for “Route 10 check which DNS servers are being used”. It’s a surprise to find that going to [https://www.dnscheck.tools/](https://www.dnscheck.tools/) shows a lot more results than expected. It’s critical that end-users are aware of which DNS servers are configured in the background. As it stands, I have no idea if I have DoT or DoH working right now with the default configuration, and I want to be able to ensure that Route 10 is **only** hitting the DNS servers I specify. Even though I provided my desired DNS overrides in my WAN settings, client DHCP on any VLAN also retrieves my ISP’s IPv6 DNS. ![image](https://forum.alta.inc/uploads/default/original/2X/a/abcf1d58e5254f1e685b6a1bb5822d454acea094.png) ![image](https://forum.alta.inc/uploads/default/original/2X/1/1cbc0e34a6814cfde09b99ee9c206271a018979f.png) As of right now: - What changes to configuration should be made to ensure that DHCP provides **only** the Route 10 as DNS resolver for both IPv4 and IPv6? - How can the Route 10 be configured to proxy only the DNS servers listed in the WAN settings? - How can DoT and/or DoH be set up? ---
**Author:** ![Joe](https://forum.alta.inc/letter_avatar_proxy/v4/letter/j/b9e5f3/32.png) [@Joe](https://forum.alta.inc/u/Joe)\ **Post date:** [March 17, 2025, 11:31pm UTC](https://forum.alta.inc/t/pps-documentation/3142/20 "2025-03-17T23:31:31Z")
@Alta-Chase is this on the roadmap in the near future? [Next page](https://forum.alta.inc/t/pps-documentation/3142.md?page=2)