--- sourceDocument: Australia Workflow Data Fabric sourceDocumentLink: https://www.servicenow.com/docs/r/australia/integrate-applications Release : - australia ft:locale : - en-US ft:publication_title : - Australia Workflow Data Fabric ft:clusterId : - crint bundleId : - crint workflow : - Creator --- # Reverse Tunnel architecture # Reverse Tunnel architecture {#ariaid-title1} Release version: Australia Updated September 29, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Reverse Tunnel architecture The Reverse Tunnel architecture enables secure, outbound connections from your private relay to your ServiceNow instance and associated gateway hosts. This setup supports data requests from your network to ServiceNow through controlled ports and authenticated connections, facilitating seamless and secure data integration without inbound firewall openings. Show full answer Show less ## Key Features * **Private Relay Connection:** The private relay initiates outbound connections to your ServiceNow instance on port 443 for registration, certificate requests, and configuration retrieval. * **Gateway Host Connections:** The relay opens outbound connections to multiple gateway hosts on two specific ports---an admin port (4290) for tunnel management and health checks, and a data port (4281) to route data requests. * **Authentication:** Mutual TLS (mTLS) authentication secures communication between the relay and gateways. * **Redundancy:** Multiple gateway hosts provide reliability and failover capabilities, with ServiceNow managing the number of hosts dynamically. ## Practical Network Configuration * Ensure outbound firewall rules allow the relay host to connect on port 443 to your ServiceNow instance as a first step, enabling relay registration and configuration. * After registration, verify gateway hostnames appear in the relay record, then open outbound access to the gateway hosts on both the data port (4281) and admin port (4290). * Firewall configurations must accommodate multiple gateway hosts for redundancy, requiring access on both ports for each host. * Port and hostname details are dynamic; network administrators should refer to the relay records for current gateway hostnames and port assignments. ## Key Outcomes By implementing the Reverse Tunnel architecture with correctly configured outbound firewall rules, ServiceNow customers can securely enable data source requests from their internal networks to ServiceNow without exposing inbound ports. This architecture enhances security, reliability, and ease of integration by managing connections through authenticated, outbound tunnels. A private relay opens outbound connections to your instance and to the gateway. Knowing the ports and their purposes helps you configure firewall rules. Reverse Tunnel requires outbound access on port 443 and on two gateway ports, a data port and an admin port. Use the information in this topic to explain the purpose of each host and port when you request firewall changes. For descriptions of the gateway, private relay, and Gateway Controller, see [Exploring Reverse Tunnel](https://www.servicenow.com/docs/ZilVwj9HaopxcNgGv1y6eg "Reverse Tunnel enables Zero Copy Connectors to reach private or on-premises data sources through encrypted outbound connections without having to open inbound firewall ports."). ## How it works {#reverse-tunnel-architecture__section_how_it_works} The figure shows the connections between the customer network and the ServiceNow network. Reverse Tunnel components communicate in the following sequence: 1. The private relay connects to your ServiceNow instance on port 443 to register, request its certificate, and retrieve its relay and tunnel configuration. 2. When the relay registers, the instance attaches gateway records to the relay record, creating them if they don't already exist. 3. The relay opens outbound connections to each gateway host on the admin port and the data port, and uses its certificate to authenticate with the gateway. 4. When Zero Copy Connectors sends a request for a data source in your network, the gateway routes the request through the data port connection to the relay. 5. The relay forwards the request to the data source registered as a service endpoint on the relay record. {#reverse-tunnel-architecture__ol_fl1_f1p_5kc} For details about how the gateway authenticates the relay, see [Reverse Tunnel mTLS authentication](https://www.servicenow.com/docs/ZK91cRArVOOyUxIyQAoGiQ "Reverse Tunnel uses mutual TLS (mTLS) to authenticate private relays before any data is exchanged. Both the gateway and the relay verify each other's identity using X.509 certificates issued by the ServiceNow iPKI service."). ## Hosts and ports the relay connects to {#reverse-tunnel-architecture__section_ports} The relay host machine requires outbound access to the hosts and ports in the following table. For gateway hosts, the Data Port and Admin Port fields in each gateway record are the source for the port numbers. The table lists the values currently in use. {#reverse-tunnel-architecture__table_gl1_f1p_5kc__entry__3} | Host | Port | Purpose | |-|-|-| | ServiceNow instance | 443 | Relay registration, certificate signing requests, retrieval of relay and tunnel configuration, and periodic checks for configuration updates | | Each gateway host | 4281 (Data Port field) | Requests from the instance to data sources in your environment | | Each gateway host | 4290 (Admin Port field) | Tunnel-related activities, such as health checks | [Table 1. Hosts and ports for the private relay] {#reverse-tunnel-architecture__table_gl1_f1p_5kc} To find the gateway hostnames for your relay, see [Verify outbound network access for a private relay](https://www.servicenow.com/docs/wDXZF7hH0dfenx1ulSinNw "Verify that the relay host machine can reach each Reverse Tunnel gateway host on the data port and the admin port."). ## Considerations {#reverse-tunnel-architecture__section_considerations} * Gateway hostnames aren't available until the relay registers with the instance. Your network administrator must open port 443 to the instance first. After the gateways appear on the relay record, open the data port and admin port to each gateway host. * The relay connects to multiple gateway hosts for redundancy and reliability. ServiceNow determines the number of gateway hosts, and the number can change. Each gateway host requires access on both the data port and the admin port. * How you configure outbound firewall rules depends on your network environment and is managed by your network administrator. {#reverse-tunnel-architecture__ul_hl1_f1p_5kc} **Related tasks** * [Verify outbound network access for a private relay](https://www.servicenow.com/docs/wDXZF7hH0dfenx1ulSinNw "Verify that the relay host machine can reach each Reverse Tunnel gateway host on the data port and the admin port.") * [Connect a private relay to the Reverse Tunnel gateway](https://www.servicenow.com/docs/eG~lQqLw8Ab7hEodlPy3TQ "Configure and register a private relay to establish an encrypted connection to the Reverse Tunnel gateway.")