---
sourceDocument: Brazil Workflow Data Fabric
sourceDocumentLink: https://www.servicenow.com/docs/r/integrate-applications

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Workflow Data Fabric

ft:clusterId :

    - crint

bundleId :

    - crint

workflow :

    - Creator


---

# Reverse Tunnel architecture

# Reverse Tunnel architecture {#ariaid-title1}

Release version: Brazil  
Updated September 29, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
A private relay opens outbound connections to your instance and to the gateway. Knowing the ports and their purposes helps you configure firewall rules.

Reverse Tunnel requires outbound access on port 443 and on two gateway ports, a data port and an admin port. Use the information in this topic to explain the purpose of each host and port when you request firewall changes.

For descriptions of the gateway, private relay, and Gateway Controller, see [Exploring Reverse Tunnel](https://www.servicenow.com/docs/7nL69YSqMfTAR074~yWMow "Reverse Tunnel enables Zero Copy Connectors to reach private or on-premises data sources through encrypted outbound connections without having to open inbound firewall ports.").

## How it works {#reverse-tunnel-architecture__section_how_it_works}

The figure shows the connections between the customer network and the ServiceNow network.

Reverse Tunnel components communicate in the following sequence:

1. The private relay connects to your ServiceNow instance on port 443 to register, request its certificate, and retrieve its relay and tunnel configuration.
2. When the relay registers, the instance attaches gateway records to the relay record, creating them if they don't already exist.
3. The relay opens outbound connections to each gateway host on the admin port and the data port, and uses its certificate to authenticate with the gateway.
4. When Zero Copy Connectors sends a request for a data source in your network, the gateway routes the request through the data port connection to the relay.
5. The relay forwards the request to the data source registered as a service endpoint on the relay record.

{#reverse-tunnel-architecture__ol_fl1_f1p_5kc}

For details about how the gateway authenticates the relay, see [Reverse Tunnel mTLS authentication](https://www.servicenow.com/docs/Ts1pGZox2yom0DddNTkdJA "Reverse Tunnel uses mutual TLS (mTLS) to authenticate private relays before any data is exchanged. Both the gateway and the relay verify each other's identity using X.509 certificates issued by the ServiceNow iPKI service.").

## Hosts and ports the relay connects to {#reverse-tunnel-architecture__section_ports}

The relay host machine requires outbound access to the hosts and ports in the following table. For gateway hosts, the Data Port and Admin Port fields in each gateway record are the
source for the port numbers. The table lists the values currently in use.  
{#reverse-tunnel-architecture__table_gl1_f1p_5kc__entry__3}

| Host | Port | Purpose |
|-|-|-|
| ServiceNow instance | 443 | Relay registration, certificate signing requests, retrieval of relay and tunnel configuration, and periodic checks for configuration updates |
| Each gateway host | 4281 (Data Port field) | Requests from the instance to data sources in your environment |
| Each gateway host | 4290 (Admin Port field) | Tunnel-related activities, such as health checks |
[Table 1. Hosts and ports for the private relay]

{#reverse-tunnel-architecture__table_gl1_f1p_5kc}

To find the gateway hostnames for your relay, see [Verify outbound network access for a private relay](https://www.servicenow.com/docs/0OIV9hu4xA3p1NQ6z85Xdg "Verify that the relay host machine can reach each Reverse Tunnel gateway host on the data port and the admin port.").

## Considerations {#reverse-tunnel-architecture__section_considerations}

* Gateway hostnames aren't available until the relay registers with the instance. Your network administrator must open port 443 to the instance first. After the gateways appear on the relay record, open the data port and admin port to each gateway host.
* The relay connects to multiple gateway hosts for redundancy and reliability. ServiceNow determines the number of gateway hosts, and the number can change. Each gateway host requires access on both the data port and the admin port.
* How you configure outbound firewall rules depends on your network environment and is managed by your network administrator.
{#reverse-tunnel-architecture__ul_hl1_f1p_5kc}
**Related tasks**   

* [Verify outbound network access for a private relay](https://www.servicenow.com/docs/0OIV9hu4xA3p1NQ6z85Xdg "Verify that the relay host machine can reach each Reverse Tunnel gateway host on the data port and the admin port.")
* [Connect a private relay to the Reverse Tunnel gateway](https://www.servicenow.com/docs/gCVbwR5rKaNxksm_NVZc1w "Configure and register a private relay to establish an encrypted connection to the Reverse Tunnel gateway.")