Network Requirements

All connections to IronFlock are outbound: browsers and edge devices connect to IronFlock, and IronFlock never connects into your network. No inbound ports need to be opened. On a network with a firewall, web filter or proxy, allow the destinations on this page.

Summary

From	Destination	Port	Needed for
Browser	`*.ironflock.com`	TCP `443` (HTTPS and WebSocket)	IronFlock Studio
Browser	`cdn.jsdelivr.net`, `unpkg.com`	TCP `443`	Dashboard widgets and the code editor
Browser	`fonts.googleapis.com`, `fonts.gstatic.com`	TCP `443`	Fonts and icons
Edge device	`*.ironflock.com`	TCP `443` (HTTPS and WebSocket)	Platform connection, app images, installation, updates and remote access
Edge device	`app.ironflock.com`	TCP `7000`	Remote access, used instead of `443` where it is open (optional)

Allow *.ironflock.com as a whole rather than single host names: IronFlock uses several subdomains, and a filter that lets only some of them through leaves Studio unable to start.

Browsers

IronFlock Studio runs in the browser. Besides the page itself, Studio connects to further ironflock.com subdomains: for signing in, and for a WebSocket connection that carries all data for as long as Studio is open.

WebSockets: proxies and web filters must allow WebSocket connections (wss://) to *.ironflock.com and must not cut them while they are in use. If your proxy inspects TLS traffic, it has to support WebSockets, or exclude *.ironflock.com from inspection.
Widgets: dashboard widgets and the code editor load from the public npm CDN cdn.jsdelivr.net, with unpkg.com as a fallback. If both are blocked, dashboards show no widgets.
Fonts and icons come from fonts.googleapis.com and fonts.gstatic.com. If they are blocked, Studio still works, but fonts and icons look different.
Payments: js.stripe.com is loaded only on the payment page of your account settings.

Company Laptops and VPNs

Managed company laptops often filter web traffic differently depending on whether the company VPN is connected. With the VPN on, traffic passes the company gateway and its rules; with the VPN off, a security client on the laptop applies its own, often stricter policy. If IronFlock works only with the VPN connected, that off-network policy has to allow *.ironflock.com too — until it does, connect the VPN when you use IronFlock.

When the Connection Is Blocked

If the browser cannot reach the IronFlock servers, Studio shows a page that names the addresses to allow, and connects automatically as soon as they are reachable. In the browser’s developer console, a blocked connection typically shows up as ERR_CONNECTION_RESET for auth.ironflock.com or cbw.ironflock.com, while the Studio page itself loads fine.

Edge Devices

The IronFlock agent on an edge device opens its connections to IronFlock and keeps them open; the device needs no open inbound ports (see Edge Devices & Agent). If your firewall does not accept wildcards, these are the destinations behind *.ironflock.com for a device connected to the IronFlock cloud:

Destination	Port	Purpose
`cbw.ironflock.com`	TCP `443` (WebSocket)	Permanent connection to the platform
`registry.ironflock.com`	TCP `443`	Downloading app images
`regauth.ironflock.com`	TCP `443`	Authorizing app image downloads
`instance-registry.ironflock.com`	TCP `443`	Installing and updating the device agent
`app.ironflock.com`	TCP `443` (WebSocket), and TCP `7000` if open	Remote access to device and app user interfaces

Remote access needs only port 443. The agent tries port 7000 first and switches to 443 on its own when 7000 is blocked, also through an HTTP proxy configured on the device. If your proxy inspects TLS traffic, the device has to trust your company’s root certificate, and the proxy has to allow WebSockets to app.ironflock.com or exclude it from inspection. Older agents use port 7000 only: if remote access fails on a network that blocks 7000, update the device agent. Without remote access the device works normally, but its user interfaces and ports cannot be opened through Remote Access.

During installation on Linux, the setup tool also installs packages from your operating system’s package mirrors and, if Docker is missing, installs it from get.docker.com and download.docker.com.

Apps can need destinations of their own, for example an external API they report to. Building an app on a device in development mode pulls the base images named in its Dockerfile from their registry, such as Docker Hub.

For a device on a restricted corporate network, also plan for:

A corporate HTTP proxy: the agent and Docker have to be told about it — see Behind a Corporate Proxy → Edge Devices.
Identity-aware firewalls: bind the rule to the device, never to a logged-in user — see Identity-Aware Firewalls and Proxies.
Time synchronization: devices need a working time server, usually over UDP 123 — see Time Synchronization (NTP).

On-Premises Appliance

An IronFlock Appliance has its own list of destinations — see Firewall Configuration. Edge devices connected to an appliance connect to the appliance instead of ironflock.com: see Devices Connecting to the Appliance.