Outgoing traffic firewall rules - Torizon OTA

Technical Support
, ,
1

Hi,

I need to provide full list of domain/ip addresses and ports Torizon OTA is using to update OS and containter images. This is needed to setup outgoing rules in firewall.
Is there any official list? I didn’t find any info in documentation.

Probably it is platform independent issue but my setup is:
Colibri iMX7D 1GB with TorizonCore OS connected to app.torizon.io

Best regards
Maciej Górnicz

2

Hi Maciej,

There are three things you may need to consider: the domain used for provisioning, the device gateway (used for all communication between the device and the platform once it’s provisioned), and any domains your docker registry is hosted on, because the docker daemon fetches image layers directly.

To provision a device, it needs access to app.torizon.io on port 443. Once provisioned, it needs access only to ota-ce.torizon.io on port 443.

The domains to whitelist for your docker registry will depend on which registry you’re using. I was able to find this article from Sonatype giving some advice on whitelisting for Docker Hub, for example.

3

For anyone finding this thread in the future, there are a couple of new additions to consider:

  • For provisioning using the Production Programming method described here, you will also need to whitelist kc.torizon.io port 443
  • For using the Remote Access feature, you will also need to whitelist ras.torizon.io ports 443 and 2222