What ports do I need to open for Mist.io
For monitoring (outgoing traffic)
In order to enable monitoring with mist.io, a server needs to allow outgoing traffic to UDP port 25826 for monitor.mist.io. Port 25826 is the port were collectd open source monitoring agent uses in order to send the monitoring data. So make sure outgoing traffic to monitor.mist.io for 25826 is allowed.
For probe/ssh (incoming traffic)
In order for mist.io to be able to run properly and ping/probe/ssh VMs incoming traffic to these ips need to be whitelisted:
126.96.36.199, 188.8.131.52, 184.108.40.206, 220.127.116.11, 18.104.22.168
The list of ips is also contained as A records in dns name ips.mist.io. To get all current ips use dig
root@user:~# dig ips.mist.io ; <<>> DiG 9.9.5-3ubuntu0.9-Ubuntu <<>> ips.mist.io ... ;; ANSWER SECTION:<br>ips.mist.io.300INA22.214.171.124 ips.mist.io. 60 IN A 126.96.36.199 ips.mist.io. 60 IN A 188.8.131.52 ips.mist.io. 60 IN A 184.108.40.206 ips.mist.io. 60 IN A 220.127.116.11 ips.mist.io. 60 IN A 18.104.22.168
To whitelist these
root@user:~# iptables -A INPUT -s ips.mist.io -j ACCEPT
Keep in mind that when dns names are used in iptables, these are resolved when the rule is being added, so in order to keep up with changes in our infrastructure, you'll need to reapply the rules periodically so that the dns entries are re-resolved.