---
title: "Ports"
slug: "ports"
updated: 2026-09-18T12:24:44Z
published: 2026-09-18T12:24:44Z
canonical: "docs.turbo360.com/ports"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.turbo360.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Ports

This article lists the network ports required for each component in the Turbo360 private hosting architecture. Use it as a reference when configuring network security group (NSG) rules, Azure Firewall policies, or any other traffic filtering layer in your private deployment.

## Overview

Turbo360's private hosting model routes all traffic through Azure private endpoints and VNet integration. To allow the platform to function correctly, your network must permit specific ports between the App Service tier, the backing data services, and the identity and monitoring endpoints that Azure requires.

### Business value

Having an accurate port reference reduces configuration errors during initial deployment and simplifies troubleshooting when connectivity issues occur. It gives your network team the exact rules to add without over-permitting traffic.

## How it works

Traffic in a Turbo360 private deployment flows in two directions. Inbound traffic reaches the web and function apps via private endpoints exposed inside your VNet. Outbound traffic leaves the App Service integration subnet toward private endpoints for Azure SQL, Storage, Application Insights, Log Analytics, and notification channels. A separate set of public egress ports is required for Azure control plane and identity services that do not support private endpoints.

## Inbound to the web/function apps (via private endpoint)

When a client calls your web app or function app via its private endpoint:

| Source → Destination | Port | Purpose |
| --- | --- | --- |
| Client in VNet → App Service private endpoint | **443/TCP** | HTTPS for all HTTP-triggered requests |

## App Service outbound via VNet integration

Web and function apps communicate **outbound** from the delegated integration subnet to private endpoints for other Azure services.

### To Azure SQL private endpoint

- **1433/TCP**: Default SQL Database port
- **11000–11999/TCP**: Additional SQL data transfer ports (for MARS and bulk copy)
- **443/TCP**: Required when using Azure AD authentication for SQL (token acquisition and redirect)

### To Azure Storage private endpoint (Blob/File)

- **443/TCP**: All Blob/File operations, including Run-From-Package ZIP load and content delivery
- **445/TCP**: Access to storage file shares

### To Application Insights private endpoint

- **443/TCP**: Telemetry ingestion

### To Log Analytics private endpoint

- **443/TCP**: Logs ingestion (Log Analytics ingestion over HTTPS, even with Private Link)

### Notification channels

- **25/TCP**: SMTP server
- **587/TCP**: SMTP server (TLS)
- **443/TCP**: API-based notification channels (e.g. ServiceNow, Teams)

## Azure control plane / identity

Even with private endpoints configured, the App Service still requires **public** egress on the following ports:

- **443/TCP**: Entra ID endpoints (`login.microsoftonline.com`, `*.aadcdn.microsoftonline-p.com`)
- **443/TCP**: Azure Resource Manager control plane
- **443/TCP**: CRL/OCSP checks for TLS certificates

## Internal DNS resolution

If using Azure Private DNS Zones:

- **53/UDP**: DNS queries from the App Service outbound subnet to your DNS forwarder or Azure DNS
- **53/TCP**: Fallback for large DNS responses

## Related articles

- [DNS entries](https://docs.turbo360.com/docs/dns-entries)
- [Environment variables](https://docs.turbo360.com/docs/environment-variables)
- [Troubleshooting private networking](https://docs.turbo360.com/docs/troubleshooting-1)