AWS Security Groups and Ports

Use two security groups that reference each other by group ID rather than by CIDR. That way every new backend that carries the worker group is allowed automatically, without editing rules when private IPs change.

Create the groups first

1. EC2 console › Network & Security › Security Groups › Create security group.
2. Create ws-gateway-sg (description: WebStream gateway control plane) in your VPC. Leave inbound empty for now.
3. Create ws-backend-sg (description: WebStream static backend fleet) in the same VPC.
4. Note both group IDs (sg-...). Create both before adding rules; each group’s rules reference the other.

Inbound rules on ws-gateway-sg

The 9000–9009 block covers the ports that matter today and leaves room for another control-plane listener without a second change round:

• 9000 — gateway registration and heartbeats. Missing this produces a silent ~21-second connect timeout in the backend log.
• 9009 — Metrics Engine. Workers post metrics and activity events here directly; they are not proxied through the gateway. Missing this loses telemetry while everything else looks healthy.
• 9008 — Access Management API (standalone listener when used; reachable but not required for registration).

Inbound rules on ws-backend-sg

• 9005 is the port the backend advertises in gateway/backend/advertisedUrl. The backend’s own pre-registration health check uses loopback, so it passes even when this rule is missing — the failure appears later as gateway-side health checks marking the backend unhealthy.
• Do not add an RDP rule sourced from ws-gateway-sg. Session RDP connections are made by the backend to itself over loopback; the gateway only speaks HTTP and WebSocket to the worker.

Streamer port maths (up to 25 sessions)

With the default basePortNumber of 9000, each pool account websNN binds two ports:

• 9000 + (NN × 10) — control / capture / audio WebSocket
• 9000 + (NN × 10) + 1 — per-session HTTP file server

Ports +2…+9 in each decade are unused. Examples:

For a 25-session pool the AWS security-group range must be 9010–9251 (general form: 9010 to 9000 + N × 10 + 1). If you size a node smaller, you may narrow the upper bound accordingly, but leaving 9251 open on the group is harmless and avoids a second change when you raise Max Sessions later.

Windows Firewall alignment

Post-install Step 3 creates a WebStream Streamers rule from the pool size. After changing Max Sessions or the pool, re-run:

C:\WebStream\Scripts\setup-server.ps1 -InstallMode Backend -UserCount 25 -ConfigureAll -Force

Outbound

Leave the default “All traffic to 0.0.0.0/0” outbound rule on both groups. If your organisation removes it:

• Backends need outbound TCP 9000 and 9009 to ws-gateway-sg.
• The gateway needs outbound 443 if it must reach external licence or AWS APIs.

Attach and verify

1. Attach ws-gateway-sg to the gateway instance and ws-backend-sg to every backend.
2. From a backend:

   Test-NetConnection <gateway-private-ip> -Port 9000
   Test-NetConnection <gateway-private-ip> -Port 9009

   Both should return True in under a second.
3. From the gateway (or an admin host that can reach the worker):

   Test-NetConnection <backend-private-ip> -Port 9005
   Test-NetConnection <backend-private-ip> -Port 9010