> For the complete documentation index, see [llms.txt](https://docs.autommate.com/userguide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.autommate.com/userguide/administration-and-runtimes/network-and-connectivity.md).

# Plan network connections and firewall rules

Build the connection plan from the components that actually communicate. A successful browser login checks only the browser-to-platform path; the runtime also needs access to the applications used by its Hyperflows.

## Identify each path

```mermaid
flowchart LR
    B["Browser"] --- C["Autom Center"]
    C --- A["Mate Agent"]
    A --- T["Target applications"]
    A --- D["Local files and dependencies"]
    X["External AI client"] --- M["Hosted MCP endpoint"]
    M --- C
```

The lines identify paths to review. Complete the actual initiator, direction, protocol and port in your environment's network matrix.

| Path                                  | Record before approval                                                                    | Check from                          |
| ------------------------------------- | ----------------------------------------------------------------------------------------- | ----------------------------------- |
| Browser → Autom Center                | Published hostname, TLS endpoint, authentication route, proxy                             | User network                        |
| Autom Center ↔ Mate Agent             | Endpoint names, initiating component, release-specific port/protocol, trust configuration | Both component hosts as applicable  |
| Mate Agent → target application       | API/database/file endpoint, required operation, destination port, credentials             | Selected Agent host                 |
| Component → identity provider         | OAuth/consent/redirect endpoints required by the connector                                | Component performing authentication |
| Component → supporting infrastructure | DNS, time source and any package, certificate or logging dependencies                     | Relevant host                       |
| MCP client → hosted MCP endpoint      | `https://mcp.autommate.app/mcp`, client OAuth support, allowed workspace                  | Selected AI client environment      |

## Apply the smallest useful rule set

Use the communication matrix supplied for your Autom Mate release to set Center–Agent rules. Restrict source and destination to the components involved. Add target-application rules for the integrations you intend to run; these are separate from the platform connection.

Earlier installation guides list TCP 5051 toward the Agent and TCP 443 toward Autom Center. Those historical values are useful when reviewing an existing installation, but must be checked against its version and endpoint configuration before changing a firewall. Do not assume a hybrid deployment uses an outbound-only tunnel.

## Test connectivity in layers

1. Resolve the intended hostname from the execution host.
2. Check the configured TCP endpoint and any proxy routing.
3. Check TLS hostname, expiry and trust chain. See [certificates](/userguide/administration-and-runtimes/certificates-and-tls.md).
4. Authenticate with the intended connection identity.
5. Run one read-only action against a known test record.
6. Confirm the expected response and inspect the action log.

This sequence separates DNS, network, certificate, authentication and application-permission failures. Record the failing layer before changing another component.

## Common symptoms

| Symptom                                  | First check                                                          |
| ---------------------------------------- | -------------------------------------------------------------------- |
| Timeout or connection refused            | Address, port, listener, routing and firewall                        |
| Certificate or trust error               | Hostname, chain, expiry and the trust store used by that process     |
| 401 response                             | Authentication method, connected account and relevant permissions    |
| Login works but an action fails          | Agent-to-target path, target object permissions and action inputs    |
| Works interactively but not as a service | Service-account access to proxy, certificate, files and dependencies |

Keep the final matrix with the installation record. Recheck affected paths after a host move, certificate replacement, proxy change or component update.