--- name: satellite-connector-understand title: Satellite Connector overview description: Satellite Connector provides secure TLS tunneling between applications and services in hybrid and multi-cloud environments using only outbound port 443. last-updated: 2026-08-27 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/satellite?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Satellite Connector overview {: #understand-connectors} Satellite Connector provides secure TLS tunneling between applications and services in hybrid and multi-cloud environments using only outbound port 443. {: shortdesc} Satellite Connector allows hybrid cloud connectivity for edge devices needing persistent connectivity. It enables advertising of trusted services that are capable of establishing secure end-point connectivity. With Satellite Connector, you can maintain data sovereignty with on-premises applications and services while connecting securely over a public network interface. ![Satellite Connector](images/satellite-connector.svg "Satellite Connector"){: caption="Satellite Connector" caption-side="bottom"} A Satellite Connector is a deployment model that enables only the secure communications from IBM Cloud to on-prem resources with a light-weight container that is deployed on your container platform hosts, such as Docker hosts. This option brings all the security and auditability of Satellite communication, but with fewer resources required. The following key concepts apply to Satellite Connector. Connector {: #term-connector} : A connector provides a secure connection between a specific remote location and IBM Cloud. Agent {: #term-agent} : Each connector needs an agent running on your location to establish the connection. Endpoint {: #term-endpoint} : An endpoint is the Connector term for the service being accessed across the Connector service. Endpoints are either the fully qualified domain names (FQDNs) or the IP addresses of the resources being made available across Satellite Connector. An endpoint is not limited to HTTP (Hypertext Transfer Protocol) or HTTPS traffic, but supports any protocol that works across a TCP (Transmission Control Protocol) connection. Access control list {: #term-acl} : Because endpoints are exposed privately within IBM Cloud to all IBM Cloud resources, including other customers' resources, an access control list (ACL) restricts access by defining which IP addresses or Classless Inter-Domain Routing (CIDR) ranges are allowed to use the endpoint. ## Minimum requirements {: #min-requirements} These minimum requirements are for running the agent image only and exclude what's needed to run the container platform. {: note} To run the Satellite Connector agent image, your computing environment must meet the following minimum requirements. - Central processing unit (CPU): 0.40 - Memory: 500M - The Connector agent image is available for multiple architectures: x86_64 (amd64), ARM64 (arm64), PowerPC 64-bit Little Endian (ppc64le), and IBM Z (s390x). - If you are on a Mac with Apple Silicon (arm64), the image works natively. For older x86-only images, Rosetta can be used for emulation. If Rosetta is not installed on your Mac, you can install it via the `softwareupdate --install-rosetta` command. - Connector agent for Windows supports Windows 10 and later or Windows Server 2016 and later. - The Windows server where you run your Connector agent must have at least 4 cores and 4GB memory. - For high availability, IBM recommends deploying at least 6 agents, with 1 agent per host, distributed across separate physical machines. ## Network requirements {: #network-requirements} To pull the Satellite Connector agent image, you must allow the following connection so that hosts can communicate with IBM Cloud Container Registry. - Destination IP addresses: N/A - Destination hostnames: `icr.io` - Protocol and ports: HTTPS 443 The Satellite Connector agent that runs in your environment needs public outbound connectivity to IBM Cloud. This can be direct public access or via a proxy. There is no requirement for public inbound access. See the [Configuring a proxy for your Satellite Connector](https://cloud.ibm.com/docs/satellite?topic=satellite-connector-agent-path&format=markdown) for more information about using a proxy. The list of endpoints, including URLs and IP Addresses, that must be outbound accessible depends on the region you specified when creating the Satellite Connector. See the entry for your region in the following list. Dallas : * Destination IP addresses: 169.46.88.106, 169.61.31.178, 169.61.156.226 * Destination hostnames: `c-01-ws.us-south.link.satellite.cloud.ibm.com`, `api.link.satellite.cloud.ibm.com`, `iam.cloud.ibm.com` * Protocol and ports: HTTPS 443 Frankfurt : * Destination IP addresses: 149.81.188.130, 158.177.75.210, 161.156.38.2 * Destination hostnames: `c-01-ws.eu-de.link.satellite.cloud.ibm.com`, `api.link.satellite.cloud.ibm.com`, `iam.cloud.ibm.com` * Protocol and ports: HTTPS 443 London : * Destination IP addresses: 158.175.130.138, 141.125.87.226, 158.176.74.242, 158.176.177.12, 141.125.159.214, 158.175.176.32 * Destination hostnames: `c-01-ws.eu-gb.link.satellite.cloud.ibm.com`, `api.link.satellite.cloud.ibm.com`, `iam.cloud.ibm.com` * Protocol and ports: HTTPS 443 The following IP addresses were added on 1 September 2026: `158.176.177.12`, `141.125.159.214`, `158.175.176.32`. {: note} Madrid : * Destination IP addresses: `13.120.67.106`, `13.121.67.82`, `13.122.67.186`, `13.120.83.28`, `13.121.82.217`, `13.122.82.84` * Destination hostnames: `c-01-ws.eu-es.link.satellite.cloud.ibm.com`, `api.link.satellite.cloud.ibm.com`, `iam.cloud.ibm.com` * Protocol and ports: HTTPS 443 The following IP addresses were added on 1 September 2026: `13.120.83.28`, `13.121.82.217`, `13.122.82.84`. {: note} Osaka : * Destination IP addresses: 163.68.78.234, 163.69.70.106, 163.73.70.50, 163.73.94.54, 163.68.80.147, 163.69.86.59 * Destination hostnames: `c-01-ws.jp-osa.link.satellite.cloud.ibm.com`, `api.link.satellite.cloud.ibm.com`, `iam.cloud.ibm.com` * Protocol and ports: HTTPS 443 The following IP addresses were added on 1 September 2026: `163.73.94.54`, `163.68.80.147`, `163.69.86.59`. {: note} Sao Paulo : * Destination IP addresses: 163.107.69.114, 163.109.70.234, 169.57.155.74, 163.107.92.34, 13.116.89.23, 163.109.91.168 * Destination hostnames: `c-01-ws.br-sao.link.satellite.cloud.ibm.com`, `api.link.satellite.cloud.ibm.com`, `iam.cloud.ibm.com` * Protocol and ports: HTTPS 443 The following IP addresses were added on 1 September 2026: `163.107.92.34`, `13.116.89.23`, `163.109.91.168`. {: note} Sydney : * Destination IP addresses: 130.198.75.74, 135.90.67.154, 168.1.201.194, 135.90.141.207, 130.198.19.60, 159.23.96.87 * Destination hostnames: `c-01-ws.au-syd.link.satellite.cloud.ibm.com`, `api.link.satellite.cloud.ibm.com`, `iam.cloud.ibm.com` * Protocol and ports: HTTPS 443 The following IP addresses were added on 1 September 2026: `135.90.141.207`, `130.198.19.60`, `159.23.96.87`. {: note} Tokyo : * Destination IP addresses: 161.202.150.66, 128.168.89.146, 165.192.71.226, 165.192.138.242, 128.168.141.55, 162.133.128.178 * Destination hostnames: `c-01-ws.jp-tok.link.satellite.cloud.ibm.com`, `api.link.satellite.cloud.ibm.com`, `iam.cloud.ibm.com` * Protocol and ports: HTTPS 443 The following IP addresses were added on 1 September 2026: `165.192.138.242`, `128.168.141.55`, `162.133.128.178`. {: note} Toronto : * Destination IP addresses: 163.74.67.114, 163.75.70.74, 158.85.79.18, 163.66.90.175, 163.74.94.50, 163.75.81.140 * Destination hostnames: `c-01-ws.ca-tor.link.satellite.cloud.ibm.com`, `api.link.satellite.cloud.ibm.com`, `iam.cloud.ibm.com` * Protocol and ports: HTTPS 443 The following IP addresses were added on 1 September 2026: `163.66.90.175`, `163.74.94.50`, `163.75.81.140`. {: note} Washington D.C. : * Destination IP addresses: 169.47.156.154, 169.63.148.250, 169.62.1.34 * Destination hostnames: `c-01-ws.us-east.link.satellite.cloud.ibm.com`, `api.link.satellite.cloud.ibm.com`, `iam.cloud.ibm.com` * Protocol and ports: HTTPS 443 ## Next steps {: #connector-understand-next-steps} - [Create a Connector](https://cloud.ibm.com/docs/satellite?topic=satellite-create-connector&format=markdown) - [Running a Connector agent](https://cloud.ibm.com/docs/satellite?topic=satellite-run-agent-locally&format=markdown) - [Running your Connector agent as a service in Docker Swarm Mode for high availability](https://cloud.ibm.com/docs/satellite?topic=satellite-run-agent-swarm&format=markdown) - [Satellite Connector end-to-end example](https://cloud.ibm.com/docs/satellite?topic=satellite-end-to-end&format=markdown)