SignLogger makes a few outbound connections to external services for licence validation, version updates, web-category data and the KamuSM timestamp used for Law 5651 log signing. If the corporate firewall, proxy or SSL inspection blocks these destinations the product runs degraded: the licence does not renew, updates do not appear, category reports stay empty and signing fails because logs cannot obtain a timestamp. This document collects the destinations to allow, why they are needed and the symptoms seen when they are blocked. Share it with your network administrator before installation.
Critical: Access from the SignLogger appliance to the destinations below is mandatory. In particular, when
zd.kamusm.gov.tris blocked the daily Law 5651 signing cannot obtain a timestamp — this directly affects legal compliance.
Destinations that must be allowed
All connections are outbound from the SignLogger appliance; no inbound port needs to be opened.
| Service | Destination | Port / Protocol | Used for | If blocked |
|---|---|---|---|---|
| Licence | license.sysnet.com.tr | TCP 4888 (HTTPS) | Licence validation, renewal and remaining-days queries | Licence does not renew and appears expired; licence-based features stay locked |
| Updates | updates.sysnet.com.tr | TCP 4999 | Version updates and automatic updates (Update Manager) | New versions are not listed, auto-update does not run, fixes do not arrive |
| Filter | filter.sysnet.com.tr | TCP 7888 | Web-category / filter database queries and updates | Category-based web reports and filter data are missing or empty |
| KamuSM timestamp | zd.kamusm.gov.tr | TCP 80 (HTTP) | TÜBİTAK Kamu SM timestamp — Law 5651 log signing | Logs cannot obtain a timestamp, daily signing fails; Law 5651 compliance is at risk |
| DNS | Corporate DNS server | UDP/TCP 53 | Resolving the names above to IP addresses | None of the destinations can be reached |
Note: Write the rules by domain name (FQDN) rather than IP; the service IPs may change. Prefer FQDN-based rules if your firewall supports them; otherwise you will need to update the rule whenever an IP changes.
How to write the firewall rule
The logic is the same regardless of vendor:
- Source: the SignLogger appliance's IP address (or its management network).
- Destination: the four domain names above.
- Service / port: the TCP port on each row (4888, 4999, 7888, 80).
- Action: Allow / Accept.
- Direction: internal network to internet (outbound). No inbound port is required.
Place the rule above any broader "block internet access" rule; otherwise the general block matches first.
SSL inspection and proxy
- SSL inspection / decryption: licence and update connections can break when an intercepting certificate is inserted. Exempt these four destinations from SSL inspection.
- Mandatory proxy: the connections are made directly from the appliance. If your organisation forces all egress through a proxy, define direct egress for these destinations; contact our support team if needed.
- Time: timestamps and signatures require a correct appliance clock; make sure an NTP source the appliance can reach (corporate NTP or the internet) is available.
How do I know something is blocked?
The following symptoms most likely mean the related destination is blocked:
| Symptom | Likely cause | Check |
|---|---|---|
| Licence renewed but the panel still shows the old expiry / "expired" | license.sysnet.com.tr:4888 blocked | Look in the firewall logs for blocked requests from the appliance to this destination |
| Update list is empty, "no updates found" | updates.sysnet.com.tr:4999 blocked | Likewise, traffic to port 4999 |
| Web-category reports are empty / category names missing | filter.sysnet.com.tr:7888 blocked | Traffic to port 7888 |
| Signing error, "timestamp could not be obtained" | zd.kamusm.gov.tr:80 blocked (or KamuSM credits exhausted) | Traffic to port 80; check the credit balance on the signing screen |
| Nothing works at all | No DNS resolution or a general egress block | The appliance's DNS setting and the general outbound rule |
For a quick test, verify from a computer on the same network segment as SignLogger that the destinations are reachable on the listed ports; if they are not, the problem is in the firewall.
Frequently Asked Questions
Which external addresses must SignLogger reach?
Four destinations: license.sysnet.com.tr (TCP 4888), updates.sysnet.com.tr (TCP 4999), filter.sysnet.com.tr (TCP 7888) and zd.kamusm.gov.tr (TCP 80). DNS is also required to resolve these names. All are outbound connections from the appliance.
What happens if these addresses are blocked?
The licence does not renew and appears expired, updates do not arrive, category reports stay empty, and daily signing fails because logs cannot obtain a timestamp from KamuSM. A signing outage directly affects Law 5651 compliance.
Why is access to zd.kamusm.gov.tr so critical?
Law 5651 log signing uses a timestamp obtained from TÜBİTAK Kamu SM; without it, that day's logs cannot be signed. While this address is blocked, records are still kept, but no signed archive is produced.
Do I need to open an inbound port?
No. All listed connections are outbound from the SignLogger appliance; no port needs to be opened from the internet towards the appliance.
Should I write the rule by IP or by domain name?
By domain name (FQDN). Service IPs may change; an FQDN-based rule is unaffected. If your firewall does not support FQDN rules, write it by IP and update it when the IP changes.
Is SSL inspection (decryption) a problem?
It can be. An intercepting inspection certificate can break the licence and update connections; we recommend exempting these four destinations from SSL inspection.
I renewed the licence but the expiry did not change in the panel — why?
The most common cause is that the appliance cannot reach license.sysnet.com.tr:4888; the renewal is processed on the licence server, but the appliance cannot query it and therefore cannot see the updated information. Once access is opened the licence status updates shortly.