Error installing personal gateway

[Abhaykumar]

We are facing the following issue while installing PowerBI Personal Gateway on a machine:

The machine has restricted outbound/inbound access to allow connections to only few domains. It seems, during installation, the installer is trying to connect to a domain not allowed by enforced restrictions. We have exception for powerbi.com and able to connect to it from the machine.

1. Is the complete executable for Personal Gateway available that can be installed without it connecting to any other domain. After installation we can configure it to connect to powerbi.com.
2. According to https://support.powerbi.com/knowledgebase/articles/649846-power-bi-personal-gateway , under Ports section, it is mentioned that Gateway communicates on TCP ports 443, 5671, 5672, 9350 thru 9354. Will gateway work if only port 443 is allowed to connect and other non-standard ports are blocked?

[Greg_Deckler]

Not sure about if it will work with only 443, but it is only outbound ports that need to be open, it does not require any inbound ports. Not sure why your security folks would configure their firewalls to block outbound ports but security folks tend to be intractable and singularly unreasonable, particularly ones that don't actually know what they are doing and thus just "block everything" by default because "it's more secure that way". Blocking outbound ports is, theorectically, a way to mitigate the damage of an exploit once it has found a foothold within your system. Of course, modern day exploits tend to use well known and almost certainly open ports (like 80, 443) in order to "phone home" these days so the real benefit of this is pretty questionable. Might save you from an exploit by an idiot hacker but if they are an idiot hacker, they probably didn't get past your defenses to implant some malware in the first place.

Stepping off of soap box...

I believe that the installer is most likely trying to contact a site to see if there are any updates to the installer package. That IP Address is registered to Akamai which is a Content Delivery Network (CDN). So, perhaps just open up that IP or Akamai IP's in order to get the installation to go through.

[Abhaykumar]

Thanks @Greg_Deckler for the reply. We tried talking to the security guys. They are talking about a lengthy process to get any other port opened or connecting to akamai domain. Meanwhile, we wanted to explore if we can get the complete installer and skip connecting to akamai. We can at least test if other ports are required to be opened or not go for the process if that is absolutely necessary.

Let us know, if by any chance, the complete installer can be got that we can copy to the server and install.

Thanks.