Some EvTrack features make EvTrack Cloud connect to systems on your own network - an access control server, a webhook endpoint, your mail server or a device on site. Your firewall sees those connections arrive from a small set of fixed public IP addresses. Add them to your firewall’s allowlist so the connections get through.
Allow these addresses
Allow all of the addresses below. EvTrack Cloud runs in several regions, and allowing every address means your integrations keep working if your system is ever moved to a different region.
| IP address | Cloud provider | Region |
|---|---|---|
35.177.220.68 | Amazon Web Services | Europe (London) |
63.176.153.77 | Amazon Web Services | Europe (Frankfurt) |
13.246.112.3 | Amazon Web Services | Africa (Cape Town) |
51.170.93.139 | Oracle Cloud | Middle East (Abu Dhabi) |
This page lists the current addresses.
What connects from these addresses
Allow the addresses on the systems and ports that EvTrack Cloud needs to reach:
- Access control integrations - Gallagher Command Centre (REST API, usually port 8904), Genetec Security Center (Web SDK, default port 4590), HikVision HikCentral (OpenAPI, port 443), Suprema BioStar 2 (HTTPS API) and Cisco ISE (ERS API, usually port 9060)
- Webhooks - HTTPS requests to the URL you configure
- Email through your own mail server - when EvTrack sends email through your SMTP server (port 25, 587 or 465)
- Devices on your site that EvTrack calls directly - for example Hikvision, Dahua, Akuvox, 2N and Axis devices and ANPR cameras, over HTTP or HTTPS (usually port 80 or 443)
Connections from your network to EvTrack Cloud
Some connections go the other way: they are opened from your network towards EvTrack Cloud. They need no entry for the addresses above, but your firewall or web proxy must allow them outbound.
EvTrack domains - allow outbound HTTPS to:
*.evtrack.com*.evtrack.net*.evtrack.me
for the Kiosk and Guard apps, FrontDesk devices, devices that push their events to EvTrack, and browsers on your network that use the EvTrack web portal.
EvTrack Connect agents connect to EvTrack Cloud through AWS IoT, using MQTT over TLS on port 8883. Allow the agent’s computer to connect outbound on TCP port 8883 to the AWS IoT endpoint in its configuration (the Broker URL in the configuration you download for the agent). The endpoints currently in use are:
a1v1ad6zs3d6vb-ats.iot.eu-west-2.amazonaws.coma1v1ad6zs3d6vb-ats.iot.eu-central-1.amazonaws.com
The agent authenticates with its own client certificate, so the connection must not pass through a proxy or firewall that inspects or re-signs TLS traffic. Exclude it from TLS inspection.
If you would rather not open any inbound access to your network, use EvTrack Connect: the agent runs on your network and connects out to EvTrack Cloud, so it needs only the outbound connection above and no inbound allowlist entry.
Notes
- These addresses are for traffic from EvTrack Cloud to your network only. They are not the address of the EvTrack web portal; to reach EvTrack, allow the outbound connections listed above.
- Allow the IP addresses themselves. Do not rely on reverse DNS names for these addresses.
- An integration’s Test Connection fails with a timeout - check your firewall log for blocked connections from the addresses above, and confirm the port is open.