Firewall Configuration for Cyber Device Manager MDM

Satish Shetty Updated by Satish Shetty

To ensure seamless communication between the Codeproof Cyber Device Manager® MDM server and managed devices, it’s essential to configure your firewall to allow specific ports, domains, and IP addresses. This guide outlines all necessary requirements for various platforms and services.

Required Firewall Ports

General Ports

  1. Port 443 (HTTPS)
    • Used for secure communication between MDM servers and devices.
  2. Port 80 (HTTP)
    • Used for fallback or non-secure communication (rarely required).

Platform-Specific Ports

Apple (iOS/macOS) MDM
  1. Port 5223 (APNs - Apple Push Notification Service)
    • Required for Apple device communication via APNs.
  2. Port 443 (HTTPS) and 2197 
    • Used for enrollment and fallback communication with Apple servers.
  3. Port 123 (NTP - Network Time Protocol)
    • Synchronizes time on Apple devices for secure communication.
Android MDM
  1. Ports 5228–5230 (Google Play Services)
    • Enables Firebase Cloud Messaging (FCM) for notifications. Refer to Google documentation is here.
  2. Port 443 (HTTPS)
    • Ensures secure communication with Google servers and Codeproof MDM.
Windows MDM
  1. Port 443 (HTTPS)
    • Facilitates secure communication with Windows devices.
  2. Port 80 (HTTP)
    • Optional fallback for enrollment communication.
  3. Port 123 (NTP)
    • Synchronizes device time for secure operations.
  4. Port 854 (WNS - Windows Notification Service)
    • Pushes notifications to Windows devices.

Required Domains and IP Addresses

Apple (iOS/macOS) MDM

  1. APNs (Apple Push Notification Service):
    *.push.apple.com
    *.apple.com
    Refer to Apple’s documentation for dynamic IP ranges.
  2. Apple Device Enrollment Program (DEP):
    deviceenrollment.apple.com
    iprod.apple.com
  3. Certificate Validation:
    *.entrust.net
    *.verisign.com

Android MDM

  1. Google Play Services & Firebase Cloud Messaging (FCM):
    mtalk.google.com
    mtalk4.google.com
    mtalk-staging.google.com
    mtalk-dev.google.com
    alt1-mtalk.google.com
    alt2-mtalk.google.com
    alt3-mtalk.google.com
    alt4-mtalk.google.com
    alt5-mtalk.google.com
    alt6-mtalk.google.com
    alt7-mtalk.google.com
    alt8-mtalk.google.com
    android.apis.google.com
    device-provisioning.googleapis.com
    firebaseinstallations.googleapis.com

Refer to Google documentation is here.

Windows MDM

  1. Windows Notification Service (WNS):
    *.notify.windows.com
    *.wns.windows.com
  2. Windows Updates (Optional):
    *.update.microsoft.com
    *.windowsupdate.com

Codeproof Specific Domains

  1. Codeproof Servers:
    *.codeproof.com

Firewall Configuration Recommendations

  1. Open the required ports for both inbound and outbound traffic as applicable.
  2. Whitelist the specified domains to ensure uninterrupted device communication.
  3. Use DNS-based whitelisting for services with dynamic IP ranges (e.g., Google and Apple).
  4. Restrict access to trusted IP ranges or domains for enhanced security.
  5. Regularly audit firewall rules to maintain compliance and reduce exposure.

Troubleshooting Tips

  1. Device Enrollment Issues:
    • Verify access to essential domains and open ports (e.g., 443, 5223).
  2. Notification Failures:
    • Ensure APNs, FCM, or WNS ports and domains are accessible.
  3. Server Connectivity Problems:
    • Check firewall logs for blocked traffic and update rules accordingly.

For additional assistance, contact Codeproof Support at support@codeproof.com

How did we do?

Managing Phone Notifications on Android

Contact