Firewall Configuration for Secure Networks
The MOBOTIX CLOUD VMS and its bridge hardware is specifically designed to be highly secure and only uses outbound TCP and UDP connections to talk to the cloud. If you restrict outbound connections on your local firewall, here is the IPv4 and port information you will need.
Note:
There can be no proxies or similar application-layer filtration devices between the MOBOTIX CLOUD Bridge and the Internet, and multicast must be enabled so the bridge can detect cameras (if the bridge and cameras are on the same subnet, generally this isn’t a problem). UPNP is NOT required (the bridge won’t use it if enabled).
For further information on the ONVIF camera discovery protocol we use, see this article on WS-Discovery. Web Service Discovery is an OASIS industry standard and generally works without much effort on most internal networks. You should not need to adjust your firewall to get it to work unless there are additional firewalls between your bridge and cameras
Outbound Ports for the MOBOTIX CLOUD Bridge
The following TCP and UDP ports are used by the MOBOTIX CLOUD Bridge. All connections are outbound-only, meaning that the bridge connects outbound and never accepts inbound connections (so you do NOT need to set up e.g. NAT rules as a general rule).
- 80/tcp # Used to discover video termination endpoints in the cloud
- 443/tcp # Used to transfer video to the cloud (TLS 1.2+)
- 773/tcp # Used to transfer video to the cloud (TLS 1.2+)
- 8081/tcp # Used to transfer video to the cloud
- 8082/udp # Used to transfer video metadata to the cloud
- 50000-60000/tcp # Used occasionally to provide remote troubleshooting and maintenance (Secured via SSL)
Ports 80 and 443 are utilized for firmware management. If these ports are filtered or blocked it can cause failed updates for our systems.
Ports 8081 and 8082 are utilized for the preview stream. If this port is filtered or blocked it will impact the preview stream stability and quality.
MOBOTIX Cloud also utilizes standard ports for our troubleshooting tools. (Ex. Ncat and Fping) These may show as being utilized on your network, but rest assured they are only for system maintenance.
Proxies:
There can be no proxies or similar application-layer filtration devices between the MOBOTIX CLOUD Bridge and the Internet, and multicast must be enabled so the bridge can detect cameras (if the bridge and cameras are on the same subnet, generally this isn’t a problem). UPNP is NOT required (the bridge won’t use it if enabled).
Outbound IPs for the MOBOTIX Cloud Bridge
Should you need to restrict the MOBOTIX CLOUD Bridge to a specific set of IP addresses, the following is the list of MOBOTIX CLOUD IP addresses you should allow in CIDR format:
MOBOTIX CLOUD VMS
209.94.248.0/26
208.81.96.0/22
216.245.88.0/21
61.120.148.0/25
210.248.158.0/24
218.102.54.64/26
223.197.211.0/25
199.204.51.0/25
62.50.13.192/27
89.202.212.160/28
195.81.42.160/27
195.81.164.160/27
212.23.62.240/28
89.202.213.96/28
95.168.179.0/27
95.168.182.32/27
95.168.185.64/26
167.248.134.0/23
167.94.38.0/23
167.94.228.0/23
192.40.4.0/23
199.45.160.0/22
Also ensure that your Firewall has our DNS sites whitelisted as well. Those sites are as follows:
*.MOBOTIXCloud.com
*.plumv.com
Outbound Ports for the MOBOTIX CLOUD Web and MOBOTIX CLOUD APP
Independent of the bridge, the MOBOTIX CLOUD Web and Mobile Applications for PCs, tablets, and phones also need to connect to the cloud to retrieve video, set settings, and so on. The ports required for this are:
- tcp/80 # HTTP->SSL Redirect Only
- tcp/443 # Web user interface
- tcp/50000-60000 # Secure video transfer
The IPs are generally the same as for the bridge.
##########################################################################
Outbound Ports for CameraDirect
Camera Direct uses the following TCP ports. All connections are outbound-only, meaning that connections are outbound and never accept inbound connections (so you do NOT need to set up e.g. NAT rules as a general rule).
80/TCP # Used to discover video termination endpoints in the cloud
443/TCP # Used to discover video termination endpoints in the cloud
8181/TCP # Used to transfer video to the cloud
MOBOTIX CLOUD Direct Subnets
167.248.134.73
167.248.135.100
167.248.135.100
192.40.4.124
192.40.5.26
Apart from these, the IP’s which are used by “Outbound IPs for the MOBOTIX CLOUD Bridge”, also need to be allowed.
MOBOTIX CLOUD utilized the 2.centos.pool.ntp.org server for NTP. Usually through port 223 as is the standard.