Firewall Settings

An Aspera server runs one SSH server on a configurable TCP port (22 by default).

Your firewall should be configured as follows:

  • To ensure that your server is secure, Aspera strongly recommends allowing inbound connections for SSH on TCP/33001 (or on another non-default, configurable TCP port), and disallowing inbound connections on TCP/22. If you have a legacy customer base utilizing TCP/22, then you can allow inbound connections on both ports.

    Open your SSH configuration file in a text editor. The configuration file is located in the following directory: /etc/ssh/sshd_config.

    Add the line Port 33001 to the configuration file to enable access to port 33001. If you are also using port 22 for shell access to the server you also need to add or uncomment the line Port 22 in the config file.

    Restart the SSH server to apply your new settings:

    # service sshd restart
  • Allow inbound connections for FASP transfers, which use UDP/33001 by default, although the server may also choose to run FASP transfers on another port.
  • If you have a local firewall on your server (such as iptables), verify that it is not blocking your SSH and FASP transfer ports (TCP/UDP 33001).
  • For the Faspex application, allow inbound connections for HTTP and/or HTTPS Web access (TCP/80, TCP/443).

The firewall on the server side must allow the open TCP port to reach the Aspera server. No servers listen on UDP ports. When a transfer is initiated by an Aspera client, the client opens an SSH session to the SSH server on the designated TCP port and negotiates the UDP port for the data transfer.