Windows Firewall and ports

MergenHub listens on two TCP ports by default and the installer opens them in Windows Firewall. This page lists every port, the rules the installer creates, and how to open, restrict or remove them by hand.

Ports MergenHub uses

Outbound connections are normally allowed by Windows Firewall; only the inbound ports need rules.

Rules the installer creates

The installer runs netsh advfirewall and adds these inbound allow rules (all profiles, TCP):

They are removed again by the uninstaller. You can see them in Windows Defender Firewall with Advanced Security › Inbound Rules.

Opening or changing ports manually

Run in an administrator command prompt:

netsh advfirewall firewall add rule name="MergenHub Web" dir=in action=allow protocol=TCP localport=8090
netsh advfirewall firewall add rule name="MergenHub OPC UA" dir=in action=allow protocol=TCP localport=48010
netsh advfirewall firewall add rule name="MergenHub HTTPS" dir=in action=allow protocol=TCP localport=443

PowerShell equivalent:

New-NetFirewallRule -DisplayName "MergenHub Web" -Direction Inbound -Protocol TCP -LocalPort 8090 -Action Allow

If you changed a port in Settings, add a rule for the new port and delete the old one:

netsh advfirewall firewall delete rule name="MergenHub Web"

Restricting who may connect

Limit a rule to specific networks instead of the whole world:

netsh advfirewall firewall set rule name="MergenHub OPC UA" new remoteip=10.0.0.0/24,192.168.10.0/24
netsh advfirewall firewall set rule name="MergenHub Web" new profile=domain,private

For internet-facing servers prefer a reverse proxy on 443 and keep 8090 bound to 127.0.0.1 (set the host to 127.0.0.1 in Settings › Web & REST API). See Publishing on a domain.

Third-party firewalls and antivirus

• Endpoint security suites (Kaspersky, ESET, Sophos …) have their own firewall; add the same TCP ports there.
• Some products flag the unsigned installer. Right-click the file › Properties › Unblock, or add an exclusion for C:\Program Files\MergenHub.
• On corporate PCs with AppLocker / WDAC the installer may be blocked entirely; ask the administrator to allow the publisher or the path.

Verifying

• From another machine: Test-NetConnection <host> -Port 8090 (PowerShell) — TcpTestSucceeded : True means the port is open.
• On the server: netstat -ano | findstr :8090 shows the listening socket and the process ID of the MergenHub service.
• The Event log (… › Event Log) shows Web API listening on … and OPC UA server started lines when the services are up.

Troubleshooting