Skip to content
English
Contact us
  • There are no suggestions because the search field is empty.

What does our IT team need to prepare?

Provide required outbound internet access without opening unsolicited inbound connections.

The Device needs internet access through Wi-Fi or cellular data. All connections are initiated by the Device. No unsolicited inbound connection, inbound firewall rule, port forwarding, VPN, public IP address, or direct internet access to the Device is required. Return traffic for Device-initiated connections must be permitted.

The Device does not require Ethernet or access to internal databases, servers, business applications, industrial control systems, or operational-technology networks. It can be placed on a guest network, dedicated wireless network, VLAN, or isolated network segment, provided the destinations below are allowed.

Required outbound destinations

| Service | Destination | Port and protocol | |--------------------------------------------|-----------------------------------------------------------------------------------------|-------------------------------| | OPTOVERA services | api.sobereye.net, api.optovera.net, sobereyeenterprise-media.s3.us-east-1.amazonaws.com | TCP 443 | | Apple Push Notification service (APNs) | \*.push.apple.com | TCP 5223; TCP 443 as fallback | | Apple device services | \*.apple.com | TCP 80 and 443 | | Apple software-update CDN | \*.cdn-apple.com | TCP 80 and 443 | | Apple application distribution | \*.itunes.apple.com | TCP 80 and 443 | | Apple application distribution and content | \.apps.apple.com, \.mzstatic.com | TCP 443 | | Apple certificate validation | certs.apple.com | TCP 80 and 443 | | Apple certificate validation | crl.apple.com, ocsp.apple.com | TCP 80 | | Apple certificate validation | ocsp2.apple.com, valid.apple.com | TCP 443 | | DigiCert certificate validation | crl3.digicert.com, crl4.digicert.com, ocsp.digicert.com | TCP 80 | | Apple time service | time-ios.apple.com, time.apple.com | UDP 123 | | Mobile Device Management | \.jamfnow.com, \.jamfcloud.com (Jamf Now); \*.mosyle.com (Mosyle) | TCP 443 |

OPTOVERA data is exchanged only with the OPTOVERA services, over HTTPS with TLS 1.2 or later. The other destinations are Apple, DigiCert, and MDM services. They use TCP 5223 for Apple push notifications, TCP 80 for certificate-status checks and software downloads, and UDP 123 for date and time synchronization. These connections are not used to exchange OPTOVERA data.

The endpoints are the same for every deployment, including where an alternative Primary Data Region has been agreed.

Firewall and proxy settings

  • Apply the rules to the Wi-Fi network or VLAN used by the Devices.
  • Permit public DNS resolution for all listed destinations.
  • Use rules based on fully qualified domain names, including wildcard domains.
  • Permit persistent outbound APNs connections on TCP 5223.
  • Do not apply HTTPS interception, SSL inspection, TLS decryption, certificate substitution, or proxy authentication to these destinations. Apple states that inspected encrypted connections may be rejected.

Where a firewall cannot use hostname-based rules, Apple publishes the network ranges 17.0.0.0/8 (IPv4) and 2403:300::/32, 2620:149::/32, and 2a01:b740::/32 (IPv6). These ranges are broader than the hostnames and should be used only when the firewall architecture requires it.

MDM commands are not delivered through inbound connections. APNs notifies the Device that a command is available, and the Device then opens an encrypted outbound connection to the MDM service to retrieve it.

The full specification is in OPTOVERA Managed Device Firewall Requirements (July 2026), available to Customer IT teams on request.