Connectivity - firewalls, proxies and outbound 8443
The agent makes exactly one outbound TLS connection, to eu.gw.wakora.io on TCP 8443,
and keeps it open. It never listens for anything from the internet. The installer
additionally fetches from get.wakora.io on TCP 443, and self-updates ride the same 8443
connection's HTTPS side. That is the whole allow-list.
Telling the failures apart
Run sudo wakora doctor. The chain of checks separates the four network failures cleanly;
the line-by-line page has the detail.
| doctor says | What it means | What to do |
|---|---|---|
dns FAIL | the name does not resolve on this host | fix the resolver, or an internal DNS zone that shadows wakora.io |
tcp 8443 FAIL | the port is blocked between the host and the endpoint | allow outbound TCP 8443 to eu.gw.wakora.io |
tls FAIL, handshake | something breaks the TLS session (a proxy that only speaks HTTP, a middlebox resetting long connections) | give the agent direct egress |
tls FAIL, key mismatch | a TLS-inspecting proxy or firewall re-signs the connection | exempt the endpoint from inspection |
A quick check without the agent:
openssl s_client -connect eu.gw.wakora.io:8443 -servername eu.gw.wakora.io </dev/null 2>/dev/null | openssl x509 -noout -subject
If the subject shows your company's proxy or firewall instead of the Wakora endpoint, the connection is being inspected and the pin will refuse it.
TLS inspection is refused on purpose
The agent pins the endpoint's public key and ignores the CA chain, so a re-signed
connection fails even when the inspecting device's CA is trusted by the operating system.
That is the guarantee that nothing between your host and Wakora can read or alter the
monitoring traffic, including a compromised middlebox. There is no switch to relax it. Ask
for eu.gw.wakora.io:8443 to bypass inspection; the traffic is monitoring telemetry from a
host you own, going to a service you chose.
Proxies
An explicit HTTP proxy is not supported today: the agent needs a direct TCP path to the endpoint. Hosts that can only reach the internet through a proxy cannot run the agent yet; see Restricted networks for what is planned there. NAT is fine; nothing needs to reach the host, so the host's address does not matter.
While the link is down
- Metrics and heartbeats are spooled to disk on the host and replayed when the connection returns, so the charts fill in rather than showing a gap. The spool is bounded by size and age; a multi-day outage keeps the newest data.
- The host is reported down in the console after about a minute of silence (a heartbeat every 30 seconds, two missed), because from the platform's side an unreachable host and a dead one look the same. When the link returns, the incident resolves on its own and the replayed heartbeats restore the availability history for the minutes the agent was alive.
- Registration retries by itself: a host installed during an outage keeps its key parked, encrypted, and registers when the endpoint answers.
Windows
The same rules apply. Windows Firewall allows outbound connections by default; a corporate
policy that blocks them shows up as tcp 8443 FAIL in wakora.exe doctor. A proxy
configured for the user does not apply to the service, which runs as SYSTEM.