How to Configure a Manual Firewall Entry on a JACE 9000

The JACE 9000 has a built-in host firewall. Services Niagara knows about are opened automatically; anything listening on another port needs a manual firewall entry.

The JACE 9000 is the first JACE built on a hardened Linux platform with its own firewall. That is good for security, but it catches engineers out: a driver that worked on a JACE 8000 suddenly receives nothing on a JACE 9000, because the port it listens on is closed. This guide explains how the firewall behaves, which ports Niagara uses, when you need a manual entry, how to add one, and how to test and document it.

Watch the JACE9000 Firewall video in our advanced engineering guides to see the screens step by step.

How the JACE 9000 firewall works

The firewall controls inbound connections to the JACE:

• Ports used by core Niagara services configured on the platform, such as platform connections, Fox/FoxS station connections and the web server, are managed as part of the platform configuration.
• Ports used by drivers and services that listen for incoming connections may not be opened automatically, especially non-standard ports or third-party modules.
• Outbound connections the JACE makes itself, for example polling a Modbus TCP device, sending email or connecting to an MQTT broker, are generally not the problem; the replies come back on the same connection.

The rule of thumb: if something on the network needs to start a conversation with the JACE on a port the platform does not already manage, add a manual firewall entry.

Ports commonly used by Niagara

Plain (non-TLS) ports should normally be disabled on production systems in favour of their TLS equivalents.

When you need a manual firewall entry

Typical situations:

• the JACE acts as a Modbus TCP server (slave) so a third-party system can read it on port 502
• a second BACnet/IP network is configured on a non-standard UDP port such as 47809
• a third-party driver listens for incoming data, for example a protocol where the field device sends unsolicited messages to the JACE
• the JACE runs an MQTT broker that other devices connect to
• SNMP monitoring or trap reception is used
• a web or Fox service has been moved to a non-default port

Symptoms are usually clear: the device or system on the other side reports a timeout or "connection refused", the JACE's driver shows nothing arriving, and the same configuration works on a JACE 8000 or a PC.

Before you add an entry

1. Confirm the service is listening. Check the driver or service is enabled in the station and configured for the port you expect.
2. Identify the exact port and protocol. TCP or UDP matters; a TCP rule will not pass UDP traffic.
3. Identify which interface traffic arrives on. The JACE 9000 has two Ethernet interfaces (en0 and en1) and, optionally, Wi-Fi. Open the port only where it is needed.
4. Check the network path. A site firewall, VLAN ACL or Windows firewall elsewhere can block the same traffic. Test from a device on the same subnet first.
5. Take a platform backup before making changes.

Adding a manual firewall entry: the process

The firewall is managed from Workbench through the JACE 9000's platform:

1. Open a platform connection to the JACE 9000 in Workbench (TLS, port 5011 by default).
2. Open the platform's network/firewall configuration, as shown in the JACE9000 Firewall video. Exact view and field names can differ between Niagara releases.
3. Add a new entry describing the traffic to allow:
   • port (for example 502)
   • protocol (TCP or UDP)
   • interface, where the option is offered (for example en0)
   • a clear description if a field is available (for example "Modbus TCP server for BMS-to-EMS link")
4. Save the configuration. Some changes take effect immediately; others require a platform restart. Follow the prompts.
5. Test from the remote device.

If you are not sure whether your Niagara release exposes a given option, check the JACE 9000 documentation for that release or contact our support team.

Testing the new entry

• TCP: from a laptop on the same subnet, test the port (for example with PowerShell Test-NetConnection 192.168.1.50 -Port 502). "TcpTestSucceeded: True" means the port is reachable.
• UDP: port tests are less conclusive because UDP has no handshake. Test with the real application (a BACnet discovery, an SNMP query) and watch the driver's statistics.
• Application level: confirm the remote system reads correct values, and check the JACE's application director output for errors.

Build a port schedule for every site

A simple port schedule avoids most firewall surprises and makes conversations with IT departments much easier:

Add a row for every new service as part of the change. The same table tells you which manual firewall entries the JACE needs and which rules the site firewall needs.

Working with IT departments

On corporate sites, the BMS often shares infrastructure with IT, and IT teams rightly want to know what every device is doing. To get approvals quickly:

• send the port schedule before installation, not after something breaks
• explain direction: most BMS traffic is inbound to controllers from known hosts, or outbound to known services
• prefer TLS: FoxS, HTTPS and MQTT over TLS are much easier to approve than plain-text protocols
• propose segmentation: a BMS VLAN with firewall rules between it and the corporate network
• agree remote access: a managed VPN or cloud remote access service, not port forwarding

Troubleshooting table

Security good practice

A firewall entry is a hole in the controller's defences, so keep each one deliberate:

• open only what is needed: one port, one protocol, the right interface
• prefer encrypted services: FoxS, HTTPS, MQTT over TLS, and disable plain-text equivalents
• restrict at the network level too: use VLANs and site firewalls so only the systems that need the port can reach it
• document every entry: port, protocol, interface, purpose, who requested it and when
• review entries at each maintenance visit and remove ones no longer needed
• never expose Niagara ports directly to the internet; use a VPN or a secure cloud service for remote access

Other JACE 9000 network gotchas

Two default gateways. If you set a default gateway on both en0 and en1, Linux keeps only the first and silently ignores the second, so traffic arriving on the other port cannot return. Set the gateway on en0 only and leave en1 blank.

SD card missing. Without its SD card, a JACE 9000 reports an incomplete Host ID and licensing fails, which can look like a network problem during commissioning.

Long first commissioning. A factory-fresh JACE 9000 can take 15 to 20 minutes or more to complete its first commissioning while the operating system and Niagara are unpacked. Increase Workbench's device reboot timeout if it gives up early, and do not power cycle the controller during this time.

Example: exposing a Modbus TCP server

A site's energy management system needs to read 40 values from the BMS. The integrator configures a Modbus TCP server (slave) in the JACE 9000 station on port 502 and maps the points. The EMS reports "connection refused". The fix:

1. confirm the Modbus server is enabled and listening on 502 in the station
2. add a manual firewall entry for TCP 502 on en0, the interface facing the EMS network
3. test from the EMS server with a port test, then with a Modbus read of a known register
4. ask site IT to restrict port 502 on the network to the EMS server's IP address
5. record the entry in the O&M documentation

Frequently asked questions

Does the JACE 9000 have a firewall?

Yes. It has a built-in host firewall that controls inbound connections. Core platform and station services are managed through the platform configuration, while other listening ports may need manual entries.

Why does my driver work on a JACE 8000 but not a JACE 9000?

If the driver listens for incoming connections, the JACE 9000 firewall may be blocking its port. Add a manual firewall entry for the port and protocol.

What port does Niagara Fox use?

Fox uses TCP 1911 and FoxS (TLS) uses TCP 4911 by default.

What port does BACnet use on a JACE?

BACnet/IP normally uses UDP 47808. Additional BACnet/IP networks may use other ports, which may need manual firewall entries.

Do I need firewall entries for outbound connections?

Usually not. Problems are almost always with inbound connections to services listening on the JACE.

Do firewall entries survive a Niagara upgrade?

They should, but always re-check firewall entries and services after upgrading or recommissioning a JACE 9000, and keep your port schedule up to date so any missing entry is quick to restore.

Should I disable plain-text ports on a JACE 9000?

Yes, once TLS equivalents are working: use FoxS instead of Fox, HTTPS instead of HTTP and platform TLS instead of plain platform connections.

Do I need a firewall entry for a Modbus TCP client connection from the JACE?

Usually not. When the JACE polls a Modbus TCP device, it opens the connection outbound and replies return on it. Entries are needed when other systems connect in to the JACE.

Does the firewall affect BACnet MS/TP or Modbus RTU?

No. Serial networks on the RS-485 ports are not IP traffic and are not affected by the IP firewall.

Can I open ports to access the JACE from the internet?

You should not expose Niagara ports directly to the internet. Use a VPN or a secure remote access service.

How do I test whether a TCP port is open on the JACE?

From a Windows PC on the same network, run Test-NetConnection with the JACE's IP address and port in PowerShell. A successful TCP test shows the port is reachable and something is listening.

Can I restrict a firewall entry to one source IP address?

Where the JACE 9000's configuration does not offer source restrictions, restrict access at the network level with VLANs and site firewall rules instead.

Need help from a Niagara engineer?

If this guide has not solved the problem, contact the Tyrrell Products technical team on 01942 732819 or [email protected]. Tell us the controller or host type, its Niagara version and what you have already tried, and we will help you get the system running.

Related guides

• What is a JACE controller?
• JACE 8000 to JACE 9000 upgrade guide
• What is Modbus?
• What is BACnet?
• JACE FAQs