Which specific URLs/domains does Grafana need whitelisted for internet access (firewall allowlist)?

Grafana
1

I’m setting up a Grafana instance in a restricted network environment where our network team requires a specific list of URLs/domains to whitelist on the firewall, rather than opening broad internet access.

Could anyone share which exact domains/URLs Grafana needs to reach for:

  1. Plugin installation & updates (e.g. grafana.com plugin catalog/CDN)
  2. Grafana Image Renderer (if used as a separate service/plugin)
  3. License validation (for Enterprise, if applicable)
  4. Update checks / telemetry (e.g. version check pings)
  5. GitHub/raw.githubusercontent.com (if any plugins pull from there during install)

If anyone has a documented list of required domains (especially for an air-gapped or tightly-controlled environment), it would be extremely helpful.

Thanks in advance!

2

The exact requirements depend on your deployment and installed plugins, but these are the primary domains typically involved (HTTPS/443) →

Plugin installation & updates
grafana.com → plugin catalog, metadata and downloads

Image Renderer
No external domains needed → only internal communication between Grafana and the renderer service required

Enterprise license validation
grafana.com → exact endpoints may vary by setup important to validate in your environment

Update checks & telemetry
grafana.com → to disable completely add to grafana.ini:
ini

[analytics]
reporting_enabled = false
check_for_updates = false
check_for_plugin_updates = false

GitHub domains

Not required for standard plugins from official Grafana catalog
Only needed for custom plugins pulling assets from GitHub:
github.com
raw.githubusercontent.com
api.github.com

For air-gapped environments, install plugins manually:
bash

grafana cli --pluginUrl https://your-internal-server/plugin.zip plugins install plugin-name

For tightly controlled environments, monitor Grafana’s actual outbound connections in a test environment first and whitelist only what your specific setup uses.

3

So just the URL grafana . com, grafana . ini, is enough if you want to install official plugins, license, etc. And for all custom plugins, just the URLs github . com, raw.githubusercontent . com, api.github . com are needed — because what matters most to me is being able to install custom plugins, and if I need official plugins, I prefer to install them manually via CLI.

4

Yes, if
You install official Grafana plugins manually from an internal repository (air gapped), and The custom plugins you use are distributed entirely through GitHub,
then you may only need access to:

  • github.com
  • raw.githubusercontent.com
  • api.github.com

To stop Grafana update checks and telemetry:

[analytics]
reporting_enabled = false
check_for_updates = false
check_for_plugin_updates = false

Official plugins can be installed manually from an internal repository:

grafana cli --pluginUrl https://your-internal-server/plugin.zip plugins install plugin-name

Just keep in mind that the actual requirements depend on the specific custom plugins you use. Some plugins may require additional domains for downloading releases or for their runtime functionality

5

Thank for your help !