ESET Port & Address Reference

_{If this project helps you, a coffee helps me keep working on it.}

Complete ESET endpoint security port and address reference lists for firewall configuration and network policy management. Essential for sysadmins deploying ESET in managed environments.

Project release: 2026.08.1. Dataset revision: 2025.06.1 (the revision published by the source matrix, independent of repository tooling releases).

Contents

Raw Lists

• Addresses.txt -- All IP addresses grouped by ESET service category
• Domains.txt -- All FQDNs grouped by ESET service category

Per-Service Files (services/)

Split by logical ESET service tier for targeted firewall rules:

File	Covers
services/updates.txt	Detection engine updates, pico updates, product installers
services/endpoint.txt	Antispam, web control, anti-theft, password manager, ESA, SSL check
services/protect-console.txt	PROTECT on-prem & cloud, EPNS, MDM, MSP, syslog, ESET Connect
services/livegrid.txt	LiveGrid reputation, advanced machine learning (Augur)
services/edtd.txt	EDTD/LiveGuard sandbox, threat telemetry, ESET Inspect (XDR)
services/activation.txt	Licensing, activation, version checks, PKI, telemetry

Machine-Readable Data

• eset-endpoints.json -- Structured JSON with fields: service, category, hosts, ips, ipv6, ports, protocol, direction, notes, source
• exports/endpoint-matrix.csv -- One row per endpoint target and port
• exports/endpoint-matrix.yml -- YAML interchange form of the JSON source
• exports/terraform-locals.tf.json -- Terraform locals payload grouped by service
• exports/ansible-vars.yml -- Ansible variables grouped by service
• exports/unifi-firewall-groups.json -- UniFi firewall group payload

Firewall Export Formats (exports/)

Ready-to-import files for common firewall platforms:

File	Platform
exports/pfsense-aliases.xml	pfSense / OPNsense alias import
exports/fortigate-addresses.conf	FortiGate address object + group CLI
exports/paloalto-addresses.xml	Palo Alto Networks address group XML
exports/mikrotik-addresslist.rsc	MikroTik RouterOS /ip firewall address-list script
exports/cisco-asa-objects.txt	Cisco ASA / Firepower object-group config
exports/windows-firewall.cmd	Windows Firewall netsh advfirewall batch script
exports/eset-allowlist-hosts.txt	Plain FQDN list for DNS allowlists / proxy bypass

Tools

• Generate-Exports.ps1 -- Regenerates all export files from eset-endpoints.json
• Test-ESETReachability.ps1 -- Tests connectivity to every listed endpoint from the current host
• Test-ESETRepository.ps1 -- Offline contract tests for syntax, data, exports, module behavior, and probe planning
• Validate-ESETData.ps1 -- Validates source data and generated files
• Compare-ESETEndpoints.ps1 -- Compares two JSON snapshots and emits an added/removed/changed report
• Resolve-ESETNetworkMap.ps1 -- Resolves DNS, emits CIDR rows, and optionally adds RIPE ASN/country metadata
• Import-ESETFirewall.ps1 -- Previews or applies named outbound Windows Firewall rules by service and protocol
• Build-Release.ps1 -- Builds a versioned ZIP and SHA256SUMS.txt
• powershell/ESET.Endpoints/ -- Importable PowerShell module for filtering and exporting endpoint rows
• site/index.html -- Generated searchable static matrix; site/feed.xml is the change-feed endpoint

Usage

Quick Start

Use the per-service files or export files directly. Import into your firewall management tool or reference during ESET deployment.

Regenerate Exports

After editing eset-endpoints.json, regenerate all export formats:

.\Generate-Exports.ps1

The generator uses meta.generated from the JSON source for all generated headers, so a clean regeneration is reproducible. It writes the CSV, YAML, infrastructure payloads, static site, and RSS feed together. Run the contract suite after changing source data:

.\Test-ESETRepository.ps1

Build a Release

.\Build-Release.ps1 -Version 2026.08.1 -DistDir .\dist
Get-Content .\dist\SHA256SUMS.txt

Pushing a vYYYY.MM.N tag runs the release workflow and publishes the ZIP and checksum manifest as a GitHub Release. The Pages workflow builds the searchable site from a clean temporary directory, so generated deployment assets never depend on local working-tree state.

Windows Firewall Rules

The batch export is a static-IP reference and emits separate TCP and UDP rules. FQDN-only targets remain in exports/eset-allowlist-hosts.txt. For named Windows Firewall rules with a profile selector, preview first and apply only after review:

.\Import-ESETFirewall.ps1 -Service updates -Profile Domain
.\Import-ESETFirewall.ps1 -Service protect-console -Profile Any -Apply -WhatIf
.\Import-ESETFirewall.ps1 -Service protect-console -Profile Any -Apply

The helper requires New-NetFirewallRule only when -Apply is supplied; preview mode is safe on non-Windows hosts.

Test Connectivity

Verify your network can reach all required ESET endpoints:

# Test all endpoints (TCP connect)
.\Test-ESETReachability.ps1

# Test only update servers
.\Test-ESETReachability.ps1 -Service updates

# Quick DNS-only check
.\Test-ESETReachability.ps1 -DnsOnly

Architecture

• architecture.mmd -- Mermaid diagram showing Endpoint to PROTECT to LiveGrid to Update flows with ports labeled per hop. Render with any Mermaid-compatible viewer or paste into mermaid.live.

Troubleshooting Checklist

Updates Failing

1. Test DNS resolution: nslookup update.eset.com
2. Test TCP 443 to update server: Test-NetConnection update.eset.com -Port 443
3. Test TCP 80 fallback: Test-NetConnection update.eset.com -Port 80
4. If using ESET Bridge/proxy, verify login.microsoftonline.com:443 is reachable
5. Check pico.eset.com:443 for micro-update delivery
6. Run .\Test-ESETReachability.ps1 -Service updates for a full check

LiveGrid Not Working

1. Test DNS: nslookup livegrid.eset.systems
2. Test TCP 443: Test-NetConnection c.eset.com -Port 443
3. Test DNS-based lookups: nslookup e5.sk (must resolve)
4. Verify UDP 53 is not blocked outbound to ESET DNS servers
5. Run .\Test-ESETReachability.ps1 -Service livegrid

Activation / License Issues

1. Test expire.eset.com:443
2. Test proxy.eset.com:443 (activation proxy)
3. Test pki.eset.com:443 (certificate validation)
4. For mobile: test reg01.eset.com through reg04.eset.com
5. Run .\Test-ESETReachability.ps1 -Service activation

PROTECT Console Cannot Reach Agents

1. Verify EPNS broker connectivity: Test-NetConnection h1-epnsbroker01.eset.com -Port 8883
2. For cloud: test protect.eset.com:443 and your regional endpoint (e.g., us02.protect.eset.com)
3. For MDM: test checkin.<region>.mdm.eset.com:443
4. Run .\Test-ESETReachability.ps1 -Service protect-console

EDTD / LiveGuard Sandbox Not Processing

1. Test r.edtd.eset.com:443 (result retrieval)
2. Test d.edtd.eset.com:443 (file submission)
3. Verify threat telemetry: Test-NetConnection tsm09.eset.com -Port 443
4. Run .\Test-ESETReachability.ps1 -Service edtd

Port Reference Summary

Port	Protocol	Used By
80/tcp	HTTP	Updates (fallback), repository downloads
443/tcp	HTTPS	All services (primary)
53/udp	DNS	LiveGrid reputation, antispam lookups
8883/tcp	MQTT/TLS	EPNS push notifications
8443/tcp	HTTPS	PROTECT Cloud agent communication
5228/tcp	FCM	Android push via Firebase Cloud Messaging
2195-2196/tcp	APNs	iOS push via Apple Push Notification service
6710-6711/tcp	TCP	Antispam greylisting database
514/tcp	Syslog	PROTECT Cloud syslog forwarding
601/tcp	Syslog/TCP	PROTECT Cloud syslog (reliable)
6514/tcp	Syslog/TLS	PROTECT Cloud syslog (encrypted)
21/tcp	FTP	Legacy FTP access (ftp.eset.sk)
25/tcp	SMTP	Inbound email from ESET notification server

Port Rationale

The ports field in eset-endpoints.json is the authoritative machine-readable contract. In operational terms:

Port	Why it is needed	Typical symptom when blocked
80/tcp	Update/repository fallback and legacy bootstrap downloads	Updates or package downloads fail when HTTPS fallback is unavailable
443/tcp	HTTPS control-plane, activation, reputation, telemetry, and downloads	Activation, cloud management, LiveGrid, or product updates time out
53/udp	DNS-based reputation and antispam lookups	Reputation/antispam decisions become slow or unavailable
8883/tcp	EPNS MQTT/TLS push wake-ups	Agents do not receive immediate wake-up notifications
8443/tcp	PROTECT Cloud agent communication where required	Cloud-managed agents cannot maintain management traffic
5228/tcp	Firebase Cloud Messaging delivery	Android push notifications are delayed or absent
2195-2196/tcp	Apple Push Notification Service delivery	iOS push notifications are delayed or absent
6710-6711/tcp	Antispam greylisting database traffic	Antispam database checks fail or degrade
514/601/6514 tcp	PROTECT Cloud syslog delivery, including reliable and TLS transports	SIEM receives no ESET audit/event stream

Updating the Reference

When ESET publishes a revised KB332 matrix:

1. Update eset-endpoints.json first and keep the official source URL in meta.source.
2. Update the matching services/*.txt files and meta.version/meta.generated.
3. Run ./Generate-Exports.ps1, then ./Test-ESETRepository.ps1.
4. Compare the previous JSON snapshot with ./Compare-ESETEndpoints.ps1 -OldJsonPath <snapshot> -UpdateChangelog.
5. Review the diff, tag the release, and publish the generated ZIP/checksum manifest.

Platform-specific additions for macOS, Linux, Cloud Office Security, and Protect Deploy are included only when the official matrix provides an explicit requirement; this repository does not infer undocumented ports from product names.

Source

Compiled from official ESET documentation and verified against production environments. Primary source: ESET KB332.

License

MIT License