Collectors must be able to initiate connections to Bindplane for OpAMP (websocket) and throughput measurements (HTTP). Bindplane will never initiate connections to the collector. The firewall can be configured to prevent Bindplane from reaching the collector networks, however, collector networks must be able to reach Bindplane on the configured port.