This article lists all network ports required for ButterflyMX devices and software to function correctly. Use this page as a reference when configuring firewalls or reviewing network access policies before or after a ButterflyMX installation.
How ButterflyMX Uses the Network
ButterflyMX devices initiate outbound connections to ButterflyMX cloud services. TCP connections are stateful — once a session is established outbound, return traffic is permitted automatically by any standard stateful firewall. UDP ports must be open bidirectionally.
If your network uses a default-allow outbound policy with stateful inspection, no firewall changes are needed. If your network uses a restrictive policy, the ports and hostnames listed below must be explicitly allowed.
The table below covers two sources: the Intercom / Application (the ButterflyMX intercom device and cloud application) and the Front Desk Station (FDS) (the desktop application used by building staff to manage calls and door access).
Required Ports
TCP is stateful — return traffic is handled automatically by stateful firewalls. If your firewall requires explicit bidirectional rules, allow both directions for TCP. UDP ports must be open in both directions.
Port |
Protocol |
Intercom / Application |
Front Desk Station (FDS) |
|---|---|---|---|
22 |
TCP |
SFTP/SCP — Used by ButterflyMX Support to transfer patches, collect logs, and perform remote maintenance when requested. Connects to AWS IP ranges. |
— |
80 |
TCP |
HTTP — General application communication. |
— |
443 |
TCP/UDP |
HTTPS — Core application traffic: cloud services, observability, remote management, and endpoint protection. Connects to AWS IP ranges. Hosts: api.butterflymx.com, feedbacks.butterflymx.com, accounts.butterflymx.com, bmx-ftp01.butterflymx.com, butterflymx.com |
HTTPS — Core FDS application traffic. Also used for ELK stack observability (error codes, system events, online/offline status, system metrics). 30-day retention. No PII. Hosts: prod-observability.kb.us-east-1.aws.found.io, *.fleet.us-east-1.aws.found.io, ipv4.icanhazip.com, api.ipify.org |
1194 |
UDP |
VPN — Backup channel for remote human support. Hosts: vpn-01.butterflymx.com through vpn-10.butterflymx.com |
— |
3478 |
TCP/UDP |
STUN/TURN — Used for video stream and call negotiation. Connects to Twilio IP ranges. |
STUN/TURN — FDS video stream negotiation. Hosts: mediaserver.butterflymx.com, stun.l.google.com (port 19302 TCP/UDP) |
5061 |
TCP |
SIP signaling — Initiating and terminating audio/video calls. Hosts: sip.butterflymx.com, sip-v4.butterflymx.com, sip-v6.butterflymx.com |
— |
5222 |
TCP |
XMPP client connection. |
— |
5223 |
TCP |
XMPP client connection (SSL). |
— |
5269 |
TCP |
XMPP server-to-server connection. |
— |
5398 |
TCP/UDP |
SIP — Call data and communication during active sessions. |
— |
8443 |
TCP |
— |
FDS video stream — Used by the Front Desk Station to receive video from the intercom during active calls. Connects to AWS IP ranges. |
8868 |
TCP |
FDS video stream. |
FDS video stream. |
10000–65535 |
TCP/UDP |
— |
FDS video stream — Dynamic port range used while an outgoing video stream is active. Host: mediaserver.butterflymx.com. Also includes inbound from mediaserver.butterflymx.com on TCP/UDP:3478 and UDP:10000–65535. |
20000–50000 |
UDP |
RTP media — Audio and video stream data during active calls. Connects to Twilio IP ranges (global.vss.twilio.com, *.turn.twilio.com, sdkgw.us1.twilio.com). Required for video calling. |
— |
51313 |
TCP/UDP |
SIP signaling and call communication. |
— |
Hostname Allowlist
If your firewall filters by hostname, allow the following connections. Entries are grouped by source.
Hostname |
Purpose |
Used By |
|---|---|---|
api.butterflymx.com |
Core application API |
Intercom |
feedbacks.butterflymx.com |
Application feedback service |
Intercom |
accounts.butterflymx.com |
Account management |
Intercom |
bmx-ftp01.butterflymx.com |
File transfer / support |
Intercom |
sip.butterflymx.com |
SIP calling |
Intercom |
sip-v4.butterflymx.com |
SIP calling (IPv4) |
Intercom |
sip-v6.butterflymx.com |
SIP calling (IPv6) |
Intercom |
butterflymx.com |
General application |
Intercom |
global.vss.twilio.com |
Twilio video/audio (RTP) |
Intercom |
*.turn.twilio.com |
Twilio TURN relay |
Intercom |
sdkgw.us1.twilio.com |
Twilio SDK gateway |
Intercom |
mediaserver.butterflymx.com |
FDS video stream |
FDS |
stun.l.google.com |
STUN — FDS video stream negotiation (port 19302) |
FDS |
prod-observability.kb.us-east-1.aws.found.io |
Observability (ELK stack) |
FDS |
*.fleet.us-east-1.aws.found.io |
Endpoint protection |
FDS |
ipv4.icanhazip.com |
Internet connectivity check |
FDS |
api.ipify.org |
Internet connectivity check |
FDS |
leaf.gocanopy.io |
Remote management |
Intercom |
bmx-ap.s3.us-east-1.amazonaws.com |
Remote management (AWS S3) |
Intercom |
bmx-panels-check.us-east-1.amazonaws.com |
Remote management (AWS EC2) |
Intercom |
vpn-01.butterflymx.com through vpn-10.butterflymx.com |
VPN endpoints (remote support) |
Intercom |
Note: Many ButterflyMX connections route through AWS EC2 and AWS S3. If your firewall uses IP-based rules, you may also need to allowlist the full AWS EC2 and AWS S3 IP address ranges.
Frequently Asked Questions
My network uses a default-allow outbound policy — do I need to do anything?
No. If your firewall uses stateful inspection and allows all outbound traffic by default, no changes are needed. Return traffic for TCP sessions and bidirectional UDP flows will be handled by the firewall automatically.
My network uses a restrictive policy — what do I need to allow?
Allow the TCP ports listed for outbound traffic. For UDP ports, allow both inbound and outbound. If your firewall also filters by hostname, add the entries in the allowlist section above.
Do the TCP ports need to be open inbound as well?
On a standard stateful firewall, no — TCP return traffic is permitted automatically once the outbound session is established. If your firewall requires explicit bidirectional rules, allow both directions for the TCP ports listed.
Port 22 looks unusual — is it required?
Port 22 (SFTP/SCP) is only used by ButterflyMX Support during remote maintenance at the customer's request. It is not used during normal operation but must be open for support activities.
What is the Front Desk Station (FDS)?
The Front Desk Station is a desktop application used by building staff to manage visitor calls, view live video from the intercom, and control door access. It has its own set of network requirements separate from the intercom device, detailed in the table above.