EV4 Connectivity and Firewall Whitelisting Requirements

Important Notice About IP-Only Whitelisting

For EV4 connectivity, using IP address whitelisting only (without allowing domain/FQDN-based rules) introduces an inherent and ongoing risk of service disruption.

Many of the cloud and infrastructure services used by EV4 rely on dynamic IP addressing. These IP addresses can and do change over time due to:

• Cloud scaling
• Load balancing
• CDN routing changes
• Regional failover events
• Provider infrastructure updates

When IP ranges change, traffic may be blocked until firewall rules are manually updated. This can result in loss of connectivity, remote access failures, time sync issues, or service outages.

Required IP Allowlisting (If FQDN Whitelisting Is Not Permitted)

If your security policy allows IP whitelisting only, you must allow and continuously maintain current IP ranges for the following providers.

Amazon Web Services (AWS)

AWS publishes its full public IP ranges here and updates them regularly:

https://ip-ranges.amazonaws.com/ip-ranges.json

These ranges must be monitored and refreshed in your firewall on an ongoing basis.

Cloudflare

Cloudflare publishes its global IP ranges here:

https://www.cloudflare.com/ips/

Both IPv4 and IPv6 ranges should be included.

TeamViewer

TeamViewer does not provide a static IP allowlist. Their infrastructure uses dynamic addressing.

Network requirements and ports are documented here:

https://www.teamviewer.com/en-us/global/support/knowledge-base/teamviewer-remote/troubleshooting/ports-used-by-teamviewer/

Because IPs are not fixed, reliable IP-only allowlisting for TeamViewer is not possible.

Google Services (1e100.net)

The domain 1e100.net is a Google-owned reverse DNS domain used across many Google services such as:

• Google APIs
• Android services
• YouTube
• Gmail
• Search
• Time services

Any Google IP address may PTR-resolve to *.1e100.net. There is no fixed IP range that can be safely or permanently allowlisted for this domain.

IP-only allowlisting based on this domain is not feasible.

NTP – pool.ntp.org

pool.ntp.org is a global, DNS load-balanced pool of thousands of time servers.

• No static IP range exists
• DNS results vary by region and availability
• Server IPs rotate frequently

IP allowlisting is therefore unreliable.

Android NTP – time.android.com

time.android.com is the default Android NTP endpoint and is an alias for Google Public NTP services.

Like pool.ntp.org, it does not have fixed IP ranges and may rotate dynamically.

Recommendation

For long-term stability and reduced operational overhead, domain/FQDN whitelisting is strongly recommended wherever possible.

FQDN-based rules allow:

• Automatic adaptation to provider IP changes
• No manual firewall updates
• Greater reliability during failover and scaling events
• Proven compatibility with EV4 deployments

Support Position

Please note the following:

• EV4 operation using IP whitelisting only is not validated by Elo.
• This configuration has not been formally tested and is not known to be in production use by other customers.
• Even with all known ranges allowlisted, connectivity issues may still occur due to dynamic IP rotation outside published ranges.

For these reasons, domain/FQDN whitelisting remains the recommended and supported approach for EV4 network access.