¶ Network and Communications Technical Manual
Updated: Jul/2026
Connectivity requirements, firewall rules, and validation for the Darwin platform and EASi products. Intended for IT and network teams.
1. Darwin - Servers and Infrastructure
¶ 1. Darwin - Servers and Infrastructure
¶ 1.1. Routing and NAT (Critical)
The solution operates with persistent sessions (WebRTC, MQTT, HTTP/3). The source IP must not change during the session, or the server drops the packets.
Restrictions:
- Do not use L4/L7 load balancing, intermediary proxy, balanced SD-WAN, or DNS round-robin for
*.easi.live - Do not use symmetric NAT (breaks STUN/ICE)
Expected behavior:
- Packets from the same session must exit through the same public IP (no fixed IP required between sessions - only consistency within each one)
- Persistent (sticky) NAT: NAT port preserved during the session
- No route change with an active session
Failover: active-passive only. Existing sessions must be restarted after a link switch.
Multiple active paths are not supported. Symptoms: freezing video, MQTT reconnecting in short cycles, intermittent API with a stable link.
¶ 1.2. Ports and Domains
| Category | Domain / Address | Port(s) | Transport | Protocol | Note | Location |
|---|---|---|---|---|---|---|
| 🌐 Web / API | *.easi.live |
443 | TCP / UDP | HTTPS / HTTP/3 | Main communication | Central / Store |
| 🌐 Web / API | api.easi.live |
443 | TCP | HTTPS | API | Store |
| 🖥️ Remote Access | remote.easi.live |
443 | TCP | HTTPS | Remote access to the server | Store |
| 🎥 Video | mqttv2.easi.live |
8883 | TCP | MQTT TLS | Telemetry | Central / Store |
| 🎥 Video | mqttv2.easi.live |
1883 | TCP | MQTT TLS | Compatibility - TLS on the AWS LB (see note) | Central / Store |
| 🎥 Video | stun.br.easi.live |
3478 | TCP / UDP | STUN | WebRTC - live video | Central / Store |
| 🎥 Video | * |
1024–65535 | UDP | RTP | WebRTC / DVR - dynamic ports | Central / Store |
| 🎥 Video | easilive.s3.amazonaws.com, s3-1-w.amazonaws.com |
443 | TCP | HTTPS | S3 - cloud video (dynamic IP) | Central / Store |
| 🕐 NTP | ntp.easi.live, a.ntp.br |
123 | UDP | NTP | Sync (required) | Store |
| 📦 Packages | storage.easi.live |
443 | TCP | HTTPS | CloudFront - packages/installers (dynamic IP) | Store |
| 📦 Packages | archive.ubuntu.com, security.ubuntu.com, ppa.launchpad.net |
443 | TCP | HTTPS | Ubuntu updates | Store |
| 🐳 Docker Images | hub.docker.com, registry-1.docker.io, auth.docker.io, index.docker.io, production.cloudflare.docker.com |
443 | TCP | HTTPS | Image pull (required) | Store |
| 🐳 Docker Images | quay.io (optional) |
443 | TCP | HTTPS | Alternative registry | Store |
| 📊 Monitoring | monitore.svc.easi.live |
443 | TCP | HTTPS | Darwin Agent | Store |
| 🏪 POS (internal) | POS → Darwin (internal) | 23454 | UDP | Proprietary | POS events | Store |
| ☎️ Telephony | <Telephony Server IP> |
80, 443, 9001 | TCP | HTTP / HTTPS | VoIP - access and API | Central / Store |
| ☎️ Telephony | <Telephony Server IP> |
8222 | TCP | Proprietary | Telephony control | Central / Store |
| ☎️ Telephony | <Telephony Server IP> |
5060 | UDP | SIP | VoIP signaling | Central / Store |
| ☎️ Telephony | <Telephony Server IP> |
10000–20000 | UDP | RTP | Voice media | Central / Store |
| ☎️ Telephony | <Phones Network> |
80, 443 | TCP | HTTP / HTTPS | Phones ↔ server | Central / Store |
Port 1883 on
mqttv2.easi.liveoperates with TLS enabled (termination on the AWS LB), even though the IANA standard defines it as unencrypted MQTT. Allow it as TLS traffic.Validation:
curl -vI https://mqttv2.easi.live:1883→ TLS 1.2 handshake completed, certificate issued byAmazon RSA 2048 M01.
¶ 1.3. Allow by FQDN (Required for Cloud)
AWS services (CloudFront, S3, ELB) do not have a fixed IP. DNS resolution returns different addresses depending on region, balancing, and availability.
Consequence: a fixed-IP firewall rule will stop working when AWS reallocates the address. This is expected AWS behavior and does not indicate a change in the Inwave system.
Rules:
- Allow by FQDN, never by IP
- In an explicit proxy, add the FQDN to the allowlist
- Do not apply SSL/DPI inspection on
*.easi.live(breaks WebRTC, MQTT, and HTTP/3) - SD-WAN must resolve the FQDN at connection time, without long caching
Domains that require FQDN: *.easi.live, storage.easi.live, easilive.s3.amazonaws.com, s3-1-w.amazonaws.com, *.docker.io, download.docker.com, production.cloudflare.docker.com.
¶ Alternatives (use with caution)
When the firewall or proxy does not support wildcard/FQDN allowing for the main domains, the following addresses can be used as an alternative:
| Service | Main domain (preferred) | Alternative |
|---|---|---|
| CloudFront | storage.easi.live |
d2tjwffk8hi2j5.cloudfront.net |
| S3 | easilive.s3.amazonaws.com |
s3-1-w.amazonaws.com |
Attention:
s3-1-w.amazonaws.comwidens the allow rule to all AWS S3 buckets, not just Inwave's. Assess the security impact before adopting.- The domain
d2tjwffk8hi2j5.cloudfront.netmay change due to maintenance or cloud infrastructure changes, without prior notice.- Whenever possible, keep the allow rule on the main domains (
storage.easi.liveandeasilive.s3.amazonaws.com).
¶ 1.4. Connectivity Validation
ping (ICMP) is not valid for cloud services - AWS and intermediary equipment frequently drop ICMP, regardless of the application state. Always validate on the application port.
¶ Test commands
| Service | Command | Expected result |
|---|---|---|
| HTTPS | curl -v https://storage.easi.live |
TLS handshake, HTTP response |
| MQTT TLS | openssl s_client -connect mqttv2.easi.live:8883 |
Certificate presented, connection established |
| Generic TCP | nc -zv api.easi.live 443 |
succeeded / open |
| STUN (UDP 3478) | stunclient stun.br.easi.live 3478 |
Mapped Address returned |
| Zabbix | nc -zv monitore.svc.easi.live 10051 |
succeeded / open |
| NTP | sntp a.ntp.br or chronyc sources |
Offset in ms/seconds |
| Docker | docker pull hello-world |
Image downloaded without TLS error |
UDP tests with
nc -zureport a false positive on firewalls with silent drop. Usestunclient(STUN) andsntp(NTP) for reliable UDP validation.
¶ Interpretation
| Scenario | Diagnosis |
|---|---|
ping fails + curl/nc succeeds |
Normal - ICMP blocked, application operating |
ping succeeds + curl/nc fails |
Firewall blocking the port - review the FQDN rule |
curl/nc fails on AWS domain |
Likely old IP-based rule - allow by FQDN |
| TLS handshake fails (invalid cert, reset) | SSL/DPI inspection in the path — add *.easi.live exception |
docker pull fails with TLS error |
SSL inspection on the Docker CDN - add exception |
| STUN without Mapped Address | UDP 3478 blocked or symmetric NAT |
| NTP with high offset or no response | UDP 123 blocked or redirected |
¶ 1.5. HTTP/3 (QUIC)
Automatically negotiated when UDP 443 is open. Fallback to HTTP/2 (TCP 443) if blocked.
- TCP 443 — required
- UDP 443 — recommended (HTTP/3)
- TCP 80 — HTTPS redirect
¶ 1.6. NTP — Time Synchronization
Functional prerequisite. Without NTP, TLS, WebRTC, authentication, and auditing fail silently.
- UDP 123 allowed (outbound) to
ntp.easi.liveanda.ntp.br - Do not intercept, redirect, or apply DPI to NTP
- Maximum accepted offset: 5 seconds
Failure symptoms: TLS error with a valid chain, intermittent login failure, WebRTC not completing the handshake, inconsistent timestamps on events.
¶ 1.7. Telephony (VoIP)
Requirements:
- Telephony VLAN enabled on the ports where the phones will be connected
- Stable site-to-site VPN between the store and VoIP servers
Rules via site-to-site VPN:
| Source → Destination | Ports |
|---|---|
| Store → Phones | TCP 80, 443 |
| Store → VoIP servers | TCP 80, 443, 8222, 9001 / UDP 5060 |
| VoIP server ↔ Phones | TCP 80, 443 / UDP 5060 / UDP 10000–20000 |
RTP uses a wide UDP range. A misconfigured SIP ALG causes one-way audio. Configure it correctly or disable it depending on the equipment.
¶ 1.8. Local Integrations
| Source → Destination | Port | Protocol |
|---|---|---|
| Darwin → MGV7 (scale) | 8080 | HTTP |
| MGV7 → Scale | 9000 | TCP |
| Darwin → local EAS (optional) | 9000 | TCP |
Internal store communication. No additional internet access needed.
¶ 1.9. Recommended Bandwidth
| Service | Recommendation |
|---|---|
| MTU | 1500 |
| Full HD video | 256 Kbps per POS |
| HD video | 128 Kbps per POS |
| Operator | 2048 Kbps |
| VoIP | 10 Mbps + QoS |
| EAS | 25 Kbps per device |
Values per simultaneous session. Size according to the expected peak.
¶ 1.10. References
- Network validation checklist - run 5 business days before deployment
- Full video communication flow - WebRTC, STUN/TURN, NAT
2. EASi (EAS)
¶ 2. EASi (EAS)
.png)
| Domain | Port | Transport | Protocol |
|---|---|---|---|
webenable.easi.live, webenable.inwavetech.com |
9000 | TCP | Proprietary |
- Minimum bandwidth: 25 Kbps per device
- Avoid Wi-Fi in environments with interference
- Allow by FQDN
3. EASiGuard
¶ 3. EASiGuard
| Domain | Port | Transport | Protocol |
|---|---|---|---|
*.easi.live |
443 | TCP | HTTPS |
storage.easi.live |
443 | TCP | HTTPS |
remote.easi.live |
443 | TCP | HTTPS |
mqtt.easi.live, mqttv2.easi.live |
8883 | TCP | MQTT TLS |
ntp.easi.live, a.ntp.br |
123 | UDP | NTP |
The FQDN and validation rules from section 1 apply.
Darwin Support Team