We strongly recommend a wired Ethernet connection for reliable performance. Wi-Fi is also supported. Each device needs at least 3 Mbps upload and download.
Devices use DHCP by default to obtain an IP address and DNS settings. If your network requires enterprise Wi-Fi credentials, a static IP address or custom DNS servers, ask IT to provide the configuration before setup.
How the device connects
The device initiates its internet connections from inside your network. You do not need to expose the device to the internet, configure port forwarding or permit unsolicited inbound internet connections. Your firewall must allow outbound connections and their return traffic.
The diagram below shows how the device, Reshape platform and image storage fit together.
The following diagram provides a network overview. Use the tables below as the service allowlist; they also include the Amazon S3 image storage and firmware download destinations not shown in this diagram.
1. Core services
These services are required for normal operation, including device communication and image uploads.
Allow outbound HTTPS traffic on TCP port 443 from the device to:
Destination | Purpose |
| Device communication and experiment data |
Both destinations must be reachable. A device may connect to your network successfully while a firewall still prevents it from communicating with these services.
2. Device management
These services support device management and software updates. We recommend allowing all destinations below to keep devices maintained and up to date.
Allow outbound HTTPS traffic on TCP port 443 from the device to:
Destination | Purpose |
| Remote device management |
| Fleet coordination |
| Software image downloads |
Blocking these services can prevent management functions or software updates even when core services remain available.
Operating system updates
The device also needs access to these package repositories for operating system and security updates:
Destination | Purpose |
| Raspberry Pi packages |
| Debian packages |
| Docker packages |
Allow outbound HTTPS on TCP port 443 to these destinations.
Network security and isolation
Internet access
Service traffic uses HTTPS. The device initiates the connections; your firewall allows the replies as part of those established connections. This does not require opening inbound ports on your internet-facing firewall.
TLS/HTTPS interception is not supported, and we cannot install customer-provided certificates or custom certificate authorities (CAs) on the device. Your IT department must exempt the device’s service connections from HTTPS inspection rather than require an inspection certificate. This is is security measure as we rely on HTTPS to secure our communication.
Network isolation
You can place the device on a dedicated VLAN or isolated network. It does not need access to your organisation’s internal applications or file shares. It still needs the network services required by your configuration, such as DNS and DHCP when automatic addressing is used.
DNS
The device must be able to resolve the service destinations listed above using your network’s DNS servers. Allow DNS queries over UDP and TCP port 53 to those servers.
DNS settings are obtained automatically through DHCP unless configured manually in netsetup. Access to public DNS servers is not required.