Firewall Rules - IP Port URL Allowlisting
Required Cloud Ports, Hosts, and IP Ranges
Ari OS uses several cloud services, such as compute and storage, across multiple providers (AWS and Azure). Ari OS also uses Cloudflare for its web infrastructure.
If your firewall has restrictions, make sure the following URLs and ports are allowlisted to utilize our services.
If you are unable to use FQDNs in your firewall we have provided IP addresses to the cloud services we use below. As our cloud services is built on highly scalable and redundant virtual hardware we are unable to provide a smaller list.
IMPORTANT
Any IP addresses / URLs contained in this document are subject to change. Refer to the IP ranges provided by our service providers for the most up-to-date information.
Admin portal
|
URL |
PORTS |
OTHER |
|
https://foresight.realwear.com |
80 (optional), 443 |
CF |
|
https://cloud.realwear.com |
80 (optional), 443 |
CF — legacy alias |
|
https://business.ari-os.com |
80 (optional), 443 |
CF — current name |
Device check-in
|
URL |
PORTS |
OTHER |
|
https://foresight.realwear.com |
80 (optional), 443 |
CF |
|
https://cloud.realwear.com |
80 (optional), 443 |
CF — legacy alias |
|
https://business.ari-os.com |
80 (optional), 443 |
CF — current name |
Device configuration
|
URL |
PORTS |
OTHER |
|
https://foresight.realwear.com |
80 (optional), 443 |
CF |
|
https://cloud.realwear.com |
80 (optional), 443 |
CF — legacy alias |
|
https://business.ari-os.com |
80 (optional), 443 |
CF — current name |
App & configuration deployment
|
URL |
PORTS |
OTHER |
|
https://foresightprod-us.azure-devices.net |
443, 5671, 1883, 853 |
Azure IoT Hub |
RealWear Cloud Storage
|
URL |
PORTS |
OTHER |
|
https://rwclouduploads.blob.core.windows.net |
443 |
Azure |
Cloud Assistance
See ports used by TV— this component is a TeamViewer integration, not a RealWear-hosted endpoint.
Firmware updates
|
URL |
PORTS |
OTHER |
|
https://fota.realwear.com |
80 (optional), 443 |
AWS & Azure |
|
https://fotadl.realwear.com |
80 (optional), 443 |
AWS & Azure |
|
https://nexus-ota-production-bdekctfeffhrecfu.canadacentral-01.azurewebsites.net/ |
80 (optional), 443 |
AWS & Azure |
NTP server
|
URL |
PORTS |
OTHER |
|
2.android.pool.ntp.org |
123 |
— |
RealTime by RealWear
|
URL |
PORTS |
OTHER |
|
global.vss.twilio.com |
443 |
Twilio |
|
au1.vss.twilio.com |
443 |
Twilio |
|
br1.vss.twilio.com |
443 |
Twilio |
|
de1.vss.twilio.com |
443 |
Twilio |
|
ie1.vss.twilio.com |
443 |
Twilio |
|
in1.vss.twilio.com |
443 |
Twilio |
|
jp1.vss.twilio.com |
443 |
Twilio |
|
sg1.vss.twilio.com |
443 |
Twilio |
|
us1.vss.twilio.com |
443 |
Twilio |
|
us2.vss.twilio.com |
443 |
Twilio |
RealWear Collaborate
|
URL |
PORTS |
OTHER |
|
https://app.realwearteams.com |
443 |
— |
Ari Cloud
User-centric product — per-user memory, files, device settings, privacy controls. Separate from the enterprise Ari Business product.
|
URL |
PORTS |
OTHER |
|
https://sapi.ari-os.com |
443 |
Cloudflare-fronted, Supabase-backed. All app data, auth session, memories, files, skills, connectors. |
|
https://ari-os.us.auth0.com |
443 |
Prod Auth0 tenant — hosted login/logout page, browser redirect. |
|
https://checkout.stripe.com |
443 |
Stripe-hosted Checkout (full-page redirect only — Stripe.js not loaded client-side). |
|
https://subscription-manager.ari-os.com |
443 |
subscription-manager billing/entitlements API |
|
https://business.ari-os.com |
443 |
Ari Business portal — link-out only, not embedded. |
|
https://graph.microsoft.com |
443 |
Direct browser fetch — profile photo, only when signed in via Microsoft. |
Ari Chat
Browser conversational interface. Carries live WebRTC voice
|
URL |
PORTS |
OTHER |
|
https://chat.ari-os.com |
443 |
Canonical front door (Vercel-hosted). |
|
https://app.ari-os.com |
443 |
Legacy alias — 301-redirects to chat.ari-os.com. Allowlist both through the transition window (~2026-08-29 review date). |
|
https://sapi.ari-os.com |
443 |
Supabase backend: data, auth proxy, connector tokens, WebRTC region-lookup. |
|
api-prod-eu.ari-os.com |
443 (signaling), UDP media per ICE |
Live prod Ari backend, EU region. |
|
ari-prod-us.ari-os.com |
443, UDP media per ICE |
US region counterpart. |
|
stun.cloudflare.com |
3478/udp (primary), 53/udp |
STUN. |
|
turn.cloudflare.com |
3478 udp/tcp, 5349 tcp (TLS), 443 tcp (fallback) |
Cloudflare managed TURN relay |
|
https://ari-os.us.auth0.com |
443 |
Prod Auth0 tenant — browser redirect for login. Distinct tenant from other RealWear apps. |
|
https://graph.microsoft.com |
443 |
Direct browser fetch — profile photo. |
|
https://login.microsoftonline.com |
443 |
OAuth consent redirect when connecting a Microsoft connector. |
|
https://subscription-manager.ari-os.com |
443 |
Entitlement/billing API. |
|
https://cloud.ari-os.com |
443 |
Navigation link to Ari Cloud only — not part of Ari Chat's own runtime traffic. ⚠ verify before publishing |
Ari Mobile
iOS/Android companion app — headset pairing, Wi-Fi handoff, device control, chat. Bluetooth/Wi-Fi-Direct traffic to the headset itself is local and excluded below; only phone-to-internet traffic is listed.
|
URL |
PORTS |
OTHER |
|
https://foresight.realwear.com |
443 |
OIDC login + device registration API. — already required by an existing table above, no new action needed |
|
*.ingest.sentry.io |
443 |
Crash/error reporting, both platforms. |
|
firebaseremoteconfig.googleapis.com |
443 |
Feature flags / forced-update gate, fetched at startup. |
|
firebaseinstallations.googleapis.com |
443 |
Firebase Installations ID, used to tag Datadog user. |
|
app-measurement.com |
443 |
Firebase Analytics event collection. |
|
api.bugfender.com |
443 |
Remote log streaming / crash reporting — iOS only, confirmed absent on Android. |
|
browser-intake-datadoghq.com |
443 |
RUM/logs telemetry — Android only, confirmed absent on iOS. |
|
api.lokalise.com |
443 |
Runtime translation bundle fetch, both platforms. |
|
itunes.apple.com |
443 |
iTunes Search API — app-update version check |
Ari (on-device client)
The voice-assistant app running directly on the headset.
|
URL |
PORTS |
OTHER |
|
https://sapi.ari-os.com |
443 |
Device registration, region-lookup for the WebRTC host, MS Graph token proxy. |
|
https://fobxmnsspafwzewmgkpl.supabase.co |
443 |
Same Supabase project as sapi.ari-os.com, used directly by the device's Supabase client (auth/rest). |
|
api-prod-eu.ari-os.com |
443 (signaling), UDP media per ICE |
Live prod Ari backend, EU region. |
|
api-prod-us.ari-os.com |
443, UDP media per ICE |
US region counterpart. |
|
stun.cloudflare.com |
3478/udp (primary), 53/udp (fallback — often ISP/browser-blocked, don't rely on it alone) |
STUN. |
|
turn.cloudflare.com |
3478 udp+tcp (primary), 53/udp or 80/tcp (fallback), 5349 tcp/TLS (primary), 443 tcp (fallback) |
TURN relay — the critical path for voice media behind a restrictive firewall. |
|
https://ari-os.us.auth0.com |
443 |
Device login (password grant). Same tenant as Ari Chat — a DIFFERENT tenant from the companion app's. |
|
o4504485976014848.ingest.us.sentry.io |
443 |
Crash/error reporting. |
|
browser-intake-datadoghq.com |
443 |
Datadog RUM/logs telemetry, US1 default site. |