Verify Egress Connectivity
If your environment has an egress firewall, confirm it allows the data plane's outbound traffic before you deploy the customer stack. A blocked endpoint fails onboarding partway through (for example, image pulls or the bastion's FRP tunnel setup). Every fix then needs another firewall change request.
Ports and protocols
All data plane traffic is outbound TCP, initiated from your data plane subnets (the VPC/VNet CIDR is a sufficient source). No inbound ports are required, apart from the control plane NAT IPs that reach the private cluster endpoint (see your cloud's prerequisites page).
| Destination | Port | Protocol | Purpose |
|---|---|---|---|
| Every domain in your cloud's Domain Allowlist (AWS, Google Cloud, Azure) | 443 | TCP (HTTPS) | Control plane APIs, image registries, tooling |
default-frp-connect.onehouse.ai | 443 and 7202 | TCP (TLS) | FRP tunnel the control plane uses to reach your private cluster |
Allowing .onehouse.ai on port 443 alone is not enough. The FRP tunnel to the Onehouse control plane also connects on TCP 7202. If 7202 is blocked, onboarding stops at the bastion's FRP setup step. When you raise a firewall change request, include default-frp-connect.onehouse.ai with ports 443 and 7202.
If your Onehouse contact tells you that your project runs on the Onehouse Google Cloud control plane, the FRP endpoint is default-frp-connect-gcp.onehouse.ai on port 443 only.
Domains in the Conditional allowlist (Confluent, Snowflake, Datadog, …) also use TCP 443. Allow them only for the features you enable. Your own data sources (Kafka brokers, databases) use the ports those systems listen on.
Run the egress check script
Download onehouse-egress-check.sh and run it from a host in the private subnets you will give the data plane. Use any Linux VM or instance there (a temporary one is fine), as long as its outbound traffic takes the same NAT and firewall path the cluster nodes will use. It needs only bash and curl, and it is read-only: it opens one outbound connection per endpoint and reports whether the firewall allowed it.
The customer stack creates the bastion host in those same private subnets. If onboarding later fails on an image pull or the FRP setup step, re-run the script from the bastion to find what is still blocked.
# AWS (pass the region the data plane runs in)
bash onehouse-egress-check.sh --cloud aws --region us-east-1
# Google Cloud / Azure
bash onehouse-egress-check.sh --cloud gcp
bash onehouse-egress-check.sh --cloud azure
# Also check your own endpoints, e.g. a Kafka broker
bash onehouse-egress-check.sh --cloud aws --extra kafka-1.internal.example.com:9092
The script checks a representative host for every Required allowlist entry, plus the FRP endpoint on each of its ports. It exits 0 when everything is reachable and 1 otherwise. It ends with the exact host:port list to send to your network team:
RESULT PORT HOST ALLOWLIST ENTRY / DETAIL
OPEN 443 cloud.onehouse.ai .onehouse.ai HTTP=200
RESET 443 production.cloudfront.docker.com production.cloudfront.docker.com connection reset during TLS (likely blocked by a firewall)
TIMEOUT 7202 default-frp-connect.onehouse.ai .onehouse.ai (FRP tunnel, TCP 7202) no response in 8s (likely dropped by a firewall)
...
SUMMARY open=33 not_open=2
Ask your network team to allow outbound TCP to these endpoints from the data plane subnets:
- production.cloudfront.docker.com:443 (TCP)
- default-frp-connect.onehouse.ai:7202 (TCP)
| Result | Meaning |
|---|---|
OPEN | The connection reached the destination. Any HTTP status, even 4xx, counts as reachable. The FRP endpoint asks for a client certificate, so it reports the handshake reaching the server instead. |
RESET / TIMEOUT | Typical of an egress firewall rejecting or dropping the connection. Allow this host and port. |
NO_DNS | The host does not resolve from this network. Check your DNS forwarding or private DNS zones. |
REFUSED | Nothing is listening at the destination. For --extra endpoints, check the host and port. |
Re-run the script after each firewall change until it reports not_open=0, then proceed to onboarding.