Firewall allowlist

This page defines the enterprise firewall rules for hopit Edge when outbound traffic is denied by default.

Rule conventions

• Use a stateful firewall. Return traffic for an established outbound connection does not need a separate inbound rule.
• Prefer FQDN rules. Microsoft, Azure, content delivery, and certificate authority addresses can change.
• Replace {operations-subnet}, {management-subnet}, and {hopit-iothub} with deployment-specific values.
• The default hopit Edge HTTPS port is TCP 5050. Replace it if hopit Edge is started with another --port value.
• A browser client is the computer on which a user opens hopit Edge or the release page. It is not necessarily the hopit Edge host.

Apply each rule at the stated network boundary. A destination needed by a browser is not automatically a hopit Edge host rule.

Base connectivity

Source	Destination	Protocol and port	Purpose	Requirement
hopit Edge host	Internal DNS resolvers	UDP/TCP 53	FQDN resolution, including TCP fallback	Required
hopit Edge host	Internal NTP sources	UDP 123	Correct time for TLS, tokens, and signed packages	Required unless time is supplied another way

DNS and NTP destinations are supplied by the customer network and therefore have no public FQDN.

Deployment and package management

hopit Edge host

Source	Destination	Protocol and port	Purpose	Requirement
hopit Edge host	repo.heap-engineering.at	TCP 443	HEAP package downloads and hopit Edge releases	Required for package management and upgrades
hopit Edge host	catalog.s.download.windowsupdate.com	TCP 443	.msu files referenced by the reviewed HEAP Windows update packages	Required for those update packages
hopit Edge host	download.visualstudio.microsoft.com	TCP 443	Install the Python package	Required when the Python package is installed

The reviewed HEAP Windows update package families are:

• windows-10-iot-enterprise-2019-ltsc-cumulative-update
• windows-10-iot-enterprise-2019-ltsc-cumulative-update-for-net
• windows-10-iot-enterprise-2019-ltsc-servicing-stack-update
• the equivalent reviewed 2016 LTSB and 2021 LTSC package families

The feed and payload are separate connections:

hopit Edge host -> repo.heap-engineering.at:443
    Package metadata and downloads

hopit Edge host -> catalog.s.download.windowsupdate.com:443
    Microsoft update payloads referenced by the package scripts

Automatic Windows Update scans and downloads are disabled. The reviewed package scripts use HTTPS URLs at catalog.s.download.windowsupdate.com, so only the package destinations in the table above are required. Recheck the scripts whenever a package is changed.

Microsoft login

Microsoft Entra login crosses the hopit Edge host and browser-client network boundaries.

Source	Destination	Protocol and port	Purpose	Requirement
hopit Edge host	login.microsoftonline.com	TCP 443	OpenID Connect discovery, signing keys, and server-side token exchange	Required when Microsoft Entra login is enabled
hopit Edge host	portal.hopit.at	TCP 443	Sign-in relay registration and portal connectivity	Required for the portal-connected Microsoft login flow
Browser client	portal.hopit.at	TCP 443	Sign-in relay callback	Required for Microsoft login
Browser client	login.microsoftonline.com	TCP 443	Interactive Microsoft Entra login	Required for Microsoft login
Browser client	Microsoft 365 endpoint sets 56 and 59	Ports published in Microsoft's endpoint feed, normally TCP 443	Login UI, static assets, MFA, and Conditional Access	Required for a Microsoft-supported interactive browser flow

Do not maintain a guessed static list of Microsoft content delivery hostnames. Consume endpoint sets 56 and 59 from Microsoft's maintained page or REST feed. Those sets include the required Microsoft identity and authentication domains.

Sources:

• Microsoft 365 URLs and IP address ranges

Azure device provisioning and IoT Hub

Source	Destination	Protocol and port	Purpose	Requirement
hopit Edge host	global.azure-devices-provisioning.net	TCP 5671	Device Provisioning Service over native AMQP/TLS	Required when DPS is configured
hopit Edge host	global.azure-devices-provisioning.net	TCP 443	DPS AMQP over WebSockets fallback	Required for the application's default fallback behavior
hopit Edge host	{hopit-iothub}.azure-devices.net	TCP 5671	IoT Hub over native AMQP/TLS	Required when Azure AMQP is configured
hopit Edge host	{hopit-iothub}.azure-devices.net	TCP 443	IoT Hub AMQP over WebSockets fallback	Required for fallback; omit only in an explicitly TCP-only configuration

Telemetry and other device-to-cloud data, cloud-to-device messages, direct methods, and device twin operations share the device-initiated IoT Hub connection. They do not require separate ports or inbound Internet rules.

Replace {hopit-iothub} with the customer-specific IoT Hub name. Do not pin Azure IoT to static IP addresses.

Sources:

• Azure IoT Hub communication protocols and ports
• Azure IoT Hub device endpoints
• DPS AMQP transport fallback

Downloading a new hopit Edge release

The hopit Edge release page asks for an email address and company name before starting the download. The browser needs all three rules:

Source	Destination	Protocol and port	Purpose	Requirement
Browser client	docs.hopit.at	TCP 443	Open release notes and the download form	Required
Browser client	mailings.heap-engineering.at	TCP 443	Submit the email address and company name	Required for the public form and download button
Browser client	repo.heap-engineering.at	TCP 443	Download the versioned hopit Edge MSI	Required to download the release

The page creates the MSI download link only after the form request succeeds. If that request is blocked, the page reports an error and does not start the download. mailings.heap-engineering.at is required for this browser workflow, but it is not a hopit Edge runtime requirement. The enterprise firewall must follow CNAME resolution for this FQDN.

Add these browser rules to the hopit Edge host only when the release page is opened locally on that host.

Certificate chains and revocation

Certificate validation can retrieve missing intermediate certificates from Authority Information Access URLs and certificate status from OCSP responders or Certificate Revocation Lists. Windows can also retrieve trusted or disallowed Certificate Trust Lists from Microsoft's trust-list service.

Concrete certificate-validation rules

Allow the following outbound rules from customer-managed hopit Edge hosts and browser clients. The certificate URLs inspected on 2026-08-25 use TCP 80.

Destination FQDNs	TCP port	Purpose	Requirement
ocsp.digicert.com, cacerts.digicert.com, crl3.digicert.com, crl4.digicert.com, oneocsp.microsoft.com, www.microsoft.com, caissuers.microsoft.com, crl2.microsoft.com	80	DigiCert and Microsoft AIA, OCSP, and CRL validation	Required
status.geotrust.com, cacerts.geotrust.com, cdp.geotrust.com	80	GeoTrust validation for the Microsoft sign-in relay at portal.hopit.at	Required when Microsoft login is enabled
yr1.i.lencr.org, yr1.c.lencr.org, yr2.i.lencr.org, yr2.c.lencr.org, yr.i.lencr.org, yr.c.lencr.org, x1.i.lencr.org, x1.c.lencr.org	80	Let's Encrypt validation for the documentation, package repository, and release form	Required for those services
ctldl.windowsupdate.com	80	Windows trusted and disallowed Certificate Trust Lists	Required for automatic root trust unless redirected to an internal location

When Microsoft login is enabled, also allow the current Microsoft 365 endpoint set 125 on TCP 80 and 443:

*.entrust.net
*.geotrust.com
*.omniroot.com
*.public-trust.com
*.symcb.com
*.symcd.com
*.verisign.com
*.verisign.net
cacerts.digicert.com
cert.int-x3.letsencrypt.org
crl.globalsign.com
crl.globalsign.net
crl.identrust.com
crl3.digicert.com
crl4.digicert.com
isrg.trustid.ocsp.identrust.com
mscrl.microsoft.com
ocsp.digicert.com
ocsp.globalsign.com
ocsp.msocsp.com
ocsp2.globalsign.com
ocspx.digicert.com
oneocsp.microsoft.com
secure.globalsign.com
www.digicert.com
www.microsoft.com

This is the complete set returned for endpoint set 125 on 2026-08-25, but Microsoft can update it. IT should consume Microsoft's endpoint web service and apply changes to set 125. The web service is an administration source, not a runtime dependency of hopit Edge.

The fixed certificate rows are also a snapshot because certificates and issuing authorities can change at renewal. Recheck the presented chains after a certificate change and verify revocation from the hopit Edge service account or system context.

Sources:

• Microsoft certificate revocation list semantics
• Configure trusted roots and disallowed certificates
• Microsoft 365 IP address and URL web service

Inbound web application and RDP access

Source	Destination	Protocol and port	Purpose	Requirement
{operations-subnet} or explicitly approved clients	hopit Edge host	TCP 5050	Open the hopit Edge HTTPS web application	Required
{management-subnet}, VPN, Remote Desktop Gateway, or jump hosts	Windows hopit Edge host	TCP 3389	Remote Desktop	Required when RDP is used
Same restricted management sources	Windows hopit Edge host	UDP 3389	RDP UDP transport	Recommended for full RDP performance

Do not expose TCP 5050 or TCP/UDP 3389 to the public Internet. Require Remote Desktop Network Level Authentication and preferably a VPN, Remote Desktop Gateway, or managed jump host.

No inbound Internet rule is needed for DPS, IoT Hub telemetry, cloud-to-device data, direct methods, or device twins.

Source: Ports used by Remote Desktop Services

TLS inspection

TLS inspection, also called HTTPS interception or decryption, means that an enterprise proxy terminates the original encrypted connection, inspects the traffic, and creates a second connection using a certificate issued by the enterprise proxy.

For Azure DPS and IoT Hub, configure the firewall or proxy as follows:

Destination	Port	Required behavior
global.azure-devices-provisioning.net	TCP 5671	Allow direct TLS pass-through. This is native AMQP, not HTTP or HTTPS proxy traffic.
{hopit-iothub}.azure-devices.net	TCP 5671	Allow direct TLS pass-through. This is native AMQP, not HTTP or HTTPS proxy traffic.
global.azure-devices-provisioning.net	TCP 443	Allow TLS pass-through without decrypting or replacing the server certificate for AMQP over WebSockets.
{hopit-iothub}.azure-devices.net	TCP 443	Allow TLS pass-through without decrypting or replacing the server certificate for AMQP over WebSockets.

A TLS inspection bypass does not allow arbitrary traffic. The destination and port restrictions still apply; the firewall simply forwards the encrypted connection without reading or modifying its contents. Package downloads over HTTPS do not require this bypass when the hopit Edge host trusts the enterprise inspection certificate.

Sources:

• Microsoft TLS inspection FAQ
• Azure IoT Hub protocols and ports

Validation checklist

Test the completed allowlist with outbound traffic denied by default:

• Open hopit Edge remotely and sign in with each enabled authentication method.
• Complete Microsoft MFA and Conditional Access, if configured.
• Provision through DPS, reconnect to IoT Hub, send telemetry, invoke a direct method, and read and update the device twin.
• Install and upgrade a normal package, a Windows update package, and the Python package.
• Open the release page, submit the form, and download the MSI.
• Verify certificate validation and revocation with empty or expired caches.
• Connect through RDP from the approved management network.

Monitor denied connections during this test, and repeat the endpoint and certificate review after relevant service or package changes.