Client network requirements
See also: Canvus Server security overview for the ports the server opens.
This page lists every network connection the MultiTaction Canvus client makes or accepts, so that you can write firewall rules for it. Most connections go out from the client. The few that come in are on the local network and only matter if you use the feature that needs them.
For each connection the page says whether Canvus needs it and how to turn it off.
Connections to the internet and to your servers
| Connection | Direction and protocol | Destination | Needed? | How to turn it off |
|---|---|---|---|---|
| Canvus Server (shared canvases) | Outbound TCP 443 with TLS (default). Outbound TCP 80 without encryption if you set protocol=tcp. Any other port you set with port=. |
Each server named in a [server:<name>] section of mt-canvus.ini |
Only if you use shared canvases | Remove the [server:<name>] sections. Canvus then works with local canvases only. |
| Live video between clients | Carried inside the Canvus Server connection above | Your Canvus Server | With the server | Not separately |
| Live video through the optional WebRTC media service | Outbound WebSocket to the server host and port above (path /ws), then UDP 40000 to 40100 for the video itself |
Your Canvus Server and its media service | Only if your server administrator has turned on the media service, which is off in the default server deployment | Leave the media service off on the server. Canvus falls back to the built-in path. |
| License service | Outbound HTTPS, TCP 443 | ls2026.multitaction.com only. Canvus uses no other host for licensing. |
Only to activate a license online, with the license wizard or --activate. The trial request and the offline activation portal are on the same host. After activation, Canvus runs without internet access until the license expires. |
Use offline activation on computers that cannot reach the internet |
| Crash report upload | None in a standard installation | None | No | The Windows client keeps crash reports on the computer and never uploads them. On Linux, the mt-canvus.sh launcher sets an upload address on diagnostics.multitaction.com over plain HTTP (TCP 80), but dumps are uploaded only if a separate upload helper is installed, and no MultiTaction package installs it. See where crash reports go. |
| Email export | Outbound SMTP. Until you configure [smtp]: TCP 587 with STARTTLS. With your own relay: the host, port and encryption you set |
Until you configure [smtp]: smtp.office365.com, a stopgap mailbox that MultiTaction provides, so recipient addresses and attachments leave your network. Then your own mail relay |
On by default. Used only when people email content from Canvus | Set an empty host= in [smtp]. See turn email off and use your own SMTP server. |
| Image search | Outbound HTTPS, TCP 443 | www.googleapis.com (the search terms only, with MultiTaction's key until you set your own), then the web sites that host the result images |
On by default. Used only when people search for images | No setting turns image search off. If you block the traffic, searches fail. See image search. |
| Web browser widgets | Outbound HTTP and HTTPS | The web sites people open. The default start page is https://www.google.com. |
Only when people open browser widgets | Not separately |
| Browser engine background services | Outbound HTTPS, TCP 443, and TCP 5228 | www.google.com, accounts.google.com, android.clients.google.com and mtalk.google.com (TCP 5228) |
Not needed by Canvus. The built-in browser engine (Chromium) opens these connections to Google services by itself when a browser widget opens, whatever page it shows; they are not requests from the page. | Canvus 26.11 has no setting that turns them off. Seen on Linux. |
| Remote desktop (RDP) | Outbound to the RDP hosts and gateways you configure | Each [remote-desktop:<name>] host and gateway |
Only if you configure RDP | Remove the [remote-desktop:<name>] sections |
| IP camera streams | Outbound to the stream address people enter | Your cameras | Only if people add IP camera streams | Not separately |
Note
Canvus Server connections default to TLS on port 443. With protocol=tcp, canvas data travels unencrypted. Use tcp only on a network you trust.
Tip
For license activation, including computers without internet access, see licensing.
Connections on the local network
| Connection | Direction and protocol | Port | Needed? | Notes |
|---|---|---|---|---|
| Remote touch from shared screens | Inbound TCP to the Canvus computer | 5010 and up. Each shared screen gets the next free port. You can pick a port by hand between 5010 and 5110. | Only if you use remote touch | Change the first port with [remote-touch] port=. Open the range from that port to that port plus 100. |
| MultiTaction displays (NetBridge touch) | Outbound TCP from the Canvus computer to each display | 5502 by default, set in config.txt |
Only on MultiTaction display walls | See input mapping |
| TUIO touch devices | Inbound UDP to the Canvus computer | 3333 by default, set in config.txt |
Only if you use TUIO touch input | See input mapping |
Canvus helper service (mt-canvus-daemon) |
Loopback only, 127.0.0.1 |
8081 by default ([remote-mount] daemon-port=) |
Used for mounting shares | Listens on the loopback address only. No firewall rule is needed. |
Proxy servers
On Linux, Canvus uses the proxy set in the http_proxy, https_proxy and no_proxy environment variables of the account that runs it (lower-case names only). This applies to the Canvus Server connection, license activation, image search and email:
http_proxysends all of this traffic through the proxy, including the Canvus Server connection, which the proxy must allow as aCONNECTtunnel to the server's port (443 by default).https_proxyalone applies to license activation and image search, but not to the Canvus Server connection.- Do not list the Canvus Server host in
no_proxywhilehttp_proxyis set: Canvus then cannot connect to that server. To keep the server connection direct, leavehttp_proxyunset and usehttps_proxyfor internet traffic. - Canvus never sends a connection to a server named
localhostor a 127.x address through the proxy.
The built-in web browser follows its own proxy rules. When Canvus runs in a desktop session such as Ubuntu's GNOME desktop, the browser uses the desktop's proxy settings (Settings > Network > Network Proxy) and ignores the environment variables. Without a desktop session it uses http_proxy and https_proxy. To force a proxy for the browser in every case, set cef-extra-switches in the [browser] section, for example cef-extra-switches=--no-sandbox --no-zygote --disable-dev-shm-usage --proxy-server=http://proxy.example.com:3128. On Linux, keep the first three switches, because the setting replaces them.
On Windows, image search uses the Windows proxy settings. For proxy setup on each platform, see install on Windows and install on Linux.
Quick checklist for a firewall request
- Allow outbound TCP 443 to your Canvus Server, or the port in your
[server:<name>]sections. - Allow outbound TCP 443 to
ls2026.multitaction.com, or plan offline activation. - Crash reports need no rule: Windows computers keep them locally, and a standard Linux installation does not upload them.
- Decide on email export. Email works out of the box through MultiTaction's stopgap mailbox (outbound TCP 587 to
smtp.office365.com). Configure[smtp]with your own mail relay and allow outbound SMTP to it, or turn email off. - Allow the web traffic your users need for browser widgets and image search. The browser engine's background connections to Google services are not needed by Canvus.
- On the local network, open the remote touch ports only if you use remote touch.