Skip to main content
Welcome to Virtru's support portal. As we work to make this page more accessible to screen readers, please contact us at support@virtru.com for technical support.

Virtru Private Keystore (for Google Workspace CSE): Reference - Firewall

  • Updated

To ensure seamless communication with Virtru endpoints and Google services, configure the following firewall rules to your server:

CSE Firewall Access Diagram (with CKS) - describes communication flows where a customer-hosted CKS server is involved for encryption key management.

CSE_Firewall_Diagram__with_CKS__-_Page_1.png

CSE Firewall Access Diagram (without CKS) - details direct communication with Virtru and Google endpoints.

CSE_Firewall_Diagram__without_CKS__-_Page_1.png

By configuring the firewall rules, you ensure that the CSE operates efficiently with Virtru services, Google APIs, and (if applicable) a customer-hosted CKS server.

Inbound Rules

  1. Port 443 (Required)

    • Purpose: Accepts traffic from end-user devices accessing Drive.
    • Source: End-user desktops (not Google services).

  2. Port 22 (Optional)

    • Purpose: Enables SSH access for server management.

Note: Google requires inbound traffic to the CSE server to be open for the above reasons.

Outbound Rules

  1. Port 443 (Required)
    • Purpose: Enables communication with the following endpoints:
      • Virtru Services:
        • Container image downloads: containers.virtru.com/cse:<tag>
        • ACM endpoints:
          • api.virtru.com/acm
          • api.virtru.com/accounts
      • Google APIs: googleapis.com
      • Identity Provider (IDP):
        • e.g., accounts.google.com for Google IDP.
      • Optional - Customer-Hosted CKS:
        • e.g., cks.customer.com

All traffic from Virtru to your server will arrive and depart on port 443. By configuring these rules, you ensure the CSE server operates smoothly with required endpoints and services.

Related articles