Configure firewall
The AI Box needs outbound internet access to reach Angible's cloud services. Allow the destinations below on the store network before the AI Box is installed. All traffic is outbound from the AI Box; no inbound ports from the internet are needed.
The destinations fall into two groups:
- Always required: the AI Box uses these for as long as it runs.
- Required during installation: needed only while the AI Box is being installed. You can close them afterwards.
Always required
Network services
| Destination | Protocol | Port | Purpose |
|---|---|---|---|
1.1.1.1, 8.8.8.8 | UDP/TCP | 53 | DNS resolution. The AI Box uses these resolvers directly instead of the store's DNS. |
*.ubuntu.pool.ntp.org, time.aws.com, ntp.ubuntu.com | UDP (NTP) | 123 | Clock sync, required for TLS and AWS request signing |
time.google.com | UDP (NTP) | 123 | Backup clock sync server |
Angible services
| Destination | Protocol | Port | Purpose |
|---|---|---|---|
cloud.angible.net | HTTPS | 443 | Angible cloud backend |
meshctl.angible.net | HTTPS | 443 | Remote management agent |
tp.angible.net | TCP | 443 | Remote access server |
monp.angible.net | HTTPS | 443 | Monitoring metrics |
AWS IoT and Greengrass (ap-southeast-1)
| Destination | Protocol | Port | Purpose |
|---|---|---|---|
a1dy8z65gfbam2-ats.iot.ap-southeast-1.amazonaws.com | MQTT over TLS, HTTPS | 8883, 443 | AWS IoT Core messaging |
c3fueyq5u1iwrd.credentials.iot.ap-southeast-1.amazonaws.com | HTTPS | 443 | AWS IoT credentials provider |
greengrass-ats.iot.ap-southeast-1.amazonaws.com | HTTPS | 443 | AWS Greengrass data plane |
greengrass.ap-southeast-1.amazonaws.com | HTTPS | 443 | AWS Greengrass deployments |
*.s3.ap-southeast-1.amazonaws.com, aibox-angible-greengrass.s3.ap-northeast-1.amazonaws.com | HTTPS | 443 | Software component downloads (Amazon S3) |
logs.ap-southeast-1.amazonaws.com | HTTPS | 443 | Logs (Amazon CloudWatch) |
Container images
| Destination | Protocol | Port | Purpose |
|---|---|---|---|
992382649631.dkr.ecr.us-west-2.amazonaws.com | HTTPS | 443 | Angible container image registry (Amazon ECR) |
api.ecr.us-west-2.amazonaws.com | HTTPS | 443 | Amazon ECR authentication |
*.s3.us-west-2.amazonaws.com | HTTPS | 443 | Amazon ECR image layer storage, e.g. prod-us-west-2-starport-layer-bucket.s3.us-west-2.amazonaws.com |
992382649631.dkr.ecr.ap-southeast-1.amazonaws.com | HTTPS | 443 | Angible container image registry, ap-southeast-1 (edge-tools component) |
api.ecr.ap-southeast-1.amazonaws.com | HTTPS | 443 | Amazon ECR authentication, ap-southeast-1 |
registry-1.docker.io | HTTPS | 443 | Docker Hub registry |
auth.docker.io | HTTPS | 443 | Docker Hub authentication |
production.cloudflare.docker.com | HTTPS | 443 | Docker Hub image download CDN |
Required during installation
| Destination | Protocol | Port | Purpose |
|---|---|---|---|
archive.ubuntu.com, *.archive.ubuntu.com, security.ubuntu.com, ports.ubuntu.com | HTTPS | 443 | Ubuntu packages |
ppa.launchpadcontent.net | HTTPS | 443 | Ansible packages |
keyserver.ubuntu.com | HTTPS | 443 | Package signing keys |
download.docker.com | HTTPS | 443 | Docker packages and signing key |
developer.download.nvidia.com, nvidia.github.io, *.download.nvidia.com | HTTPS | 443 | NVIDIA drivers and container toolkit (NVIDIA-based AI Boxes only) |
awscli.amazonaws.com | HTTPS | 443 | AWS CLI installer |
d2s8p88vqu9w66.cloudfront.net | HTTPS | 443 | AWS Greengrass installer |