The device (CloudVPN router / CloudVPN Agent) uses outgoing port(s) to establish a secure connection to the CloudVPN Portal. This means there is no need to open any incoming ports in your firewall.
How to grant network access to your device?
To grant the device the access that it requires, you may need to create exceptions in your firewall:
- for the device's ports & protocols.
- for the device in relevant company firewall settings.
- for the device to access necessary servers.
Ports & protocols
Below is an overview of all the ports and protocols that the device may utilize. If desired, please check with your device/machine supplier to see which ports and protocols are required.
| Direction | Port | Transport | Application |
|---|---|---|---|
| Outbound | 443 | TCP | HTTPS, MQTT (TLS), OpenVPN(1) |
| Outbound | 1194(2) | UDP | OpenVPN |
| Outbound | 8443(3) | TCP | HTTPS |
| Outbound | 53(4) | TCP & UDP | DNS |
| Outbound | 123(5) | UDP | NTP |
| Outbound | (no port)(6) | ICMP (Echo request) | - |
(1) The very first package may be considered unencrypted as the OpenVPN handshake takes place prior to the TLS handshake. For this reason an exception may be required on firewall rules that block non-SSL traffic over SSL-ports.
(2) (Optional) Only used when VPN connection type is set to UDP.
(3) (Optional) Only used when stealth mode is activated for connectivity via a censored internet connection (i.e. when located in China).
(4) (Optional) DNS requests are often handled by local DNS servers. In those cases the listed DNS port can be ignored.
(5) (Optional) Used to synchronize the time for its internal system log, Cloud Logging data, and providing NTP functionality to the machine.
(6) (Optional) Only used when failover is configured.
Company firewall settings
There may be firewall settings active in the local company firewall that may unintentionally interfere with the device's connection(s). These firewall settings may require changes or exceptions for the device to establish its secure connections. An overview is listed below.
| Setting | Information |
|---|---|
| MAC address filter |
Info: A firewall filter that only allows devices with a certain MAC address to establish an outgoing connection. CloudVPN: The CloudVPN router's MAC address can be found on the label on the side of the CloudVPN router. |
| IP address filter |
Info: A firewall filter that only allows outgoing connections (1) coming from devices with a certain IP address or (2) going to servers with certain IP addresses. CloudVPN: The CloudVPN router's IP address is usually set to automatic, but can be set to a static IP address if so desired. Information about the CloudVPN servers' IP addresses can be found below, at Servers & domains. |
| Application filter |
Info: A firewall filter that allows (whitelist), or blocks (blacklist), connections that are using certain application protocols. CloudVPN: The application protocols used by the device can be found above, at Ports & protocols. |
| SSL inspection, Deep packet inspection, or similar |
Info: A firewall feature that intercepts the connection and is then able to read/inspect the on-going communication (up to a certain degree). The behavior of this feature is similar to a man-in-the-middle attack, which means that something is actively inspecting or can even make changes to the remote connection and its contents. CloudVPN: The device will not establish its outgoing connections when this happens, as the security and integrity of the remote connection cannot be ensured. On a technical level the following happens: in the process of trying to establish its secure MQTT and OpenVPN connections, the device will receive an SSL certificate from the interfering party (e.g. the company firewall) and not from CloudVPN, which is untrusted for reasons explained earlier, after which it will immediately abort that connection attempt. |
Servers & domains
The device connects to different CloudVPN servers: REST API, MQTT, and OpenVPN servers, which include the following domains:
- *.ayayot.com (phonetic IIoT)
Doing a DNS lookup (nslookup) at the following domain name always returns an up-to-date IP list of all current CloudVPN servers:
- whitelist.ayayot.com
With time, some servers may be removed or added to benefit the service. We strongly try to keep these changes to a minimum. If we add a server, we simply add a DNS record to the above mentioned whitelist.ayayot.cloud. Likewise, if we remove a server, we will remove its DNS record.
To grant the device its necessary server access there is an easy and an alternative method:
Methods to configure your firewall
There are multiple methods to grant the CloudVPN router its necessary server access.
Automatic updates: single DNS whitelist
Make an exception for the following domain name in your firewall, which will always return an up-to-date IP list of all current CloudVPN servers. Your firewall will re-check the domain once the TTL expires and within an hour your firewall will be up-to-date in the event that a server is either added or removed.
Automatic updates: multiple (smaller) DNS whitelists
If your firewall can only handle up to 24 or 32 IP addresses per DNS lookup, make an exception for the following domain names in your firewall, which will always return an up-to-date IP list of all current CloudVPN servers. Each contains up to 24 IP addresses. Your firewall will re-check the domains once the TTL expires and within an hour your firewall will be up-to-date in the event that a server is either added or removed.
- a.allowlist.ayayot.com
- b.allowlist.ayayot.com
- c.allowlist.ayayot.com
- d.allowlist.ayayot.com
- e.allowlist.ayayot.com
- f.allowlist.ayayot.com
- g.allowlist.ayayot.com
- h.allowlist.ayayot.com
- i.allowlist.ayayot.com
- j.allowlist.ayayot.com
Additionally, if failover is configured in the edge gateway, also add the following domain name. If you're unsure, check with your edge gateway/machine supplier.
Automatic updates: whitelist TXT file
As alternative method, you can make your firewall regularly and automatically import and use the following TXT file, which will always return an up-to-date IP list of all current CloudVPN servers. Compatibility is firewall-dependent.
- List containing both IPv4 and IPv6 addresses:
https://allowlist.ayayot.com/ip.txt - List containing solely IPv4 addresses:
https://allowlist.ayayot.com/ipv4.txt - List containing solely IPv6 addresses:
https://allowlist.ayayot.com/ipv6.txt
Manual updates
If your firewall is incompatible with all above automatic methods, you'll need to keep your firewall updated manually. Visit the following domain name to get an IP list of all current CloudVPN servers. You can then create exceptions to these IP addresses to grant the edge gateway the access it needs.
Please keep your firewall rules/exceptions up-to-date by periodically checking the above domain name for changes to maintain optimal remote service accessibility.
Comments
0 comments
Article is closed for comments.