> For the complete documentation index, see [llms.txt](https://docs.voltmasters.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.voltmasters.io/getting-started/ems-controller-installation/internet-and-network.md).

# Internet and network

The controller manages your installation (battery, inverter, etc.) and communicates with both the Voltmasters platform and your on-site equipment. Most communication is outbound: the controller "calls out" to the cloud and to your devices. You do not need to open any inbound ports from the internet for normal operation. Remote support reaches the controller over outbound connections only (see *Remote support*).

### Requirements

* Wired network connection (Ethernet) at the location where the controller is installed.
* We prefer DHCP configuration. If you need a static IP, you need to configure this in the network configuration.
* Stable internet connection.
* Access to the same local network (LAN) as your energy devices (inverter, battery controller, meter, etc.).
* Functional DNS and the Voltmasters domains must not be blocked by DNS/content filtering (see DNS & content filtering)
* Accurate clock / NTP time sync allowed (outbound UDP 123). Required, otherwise TLS connections fail.
* No TLS-intercepting (man-in-the-middle) proxy on the controller's traffic.

### Outbound ports

Allow the following outbound connections from the controller to the internet:

<table><thead><tr><th width="98.4765625">port</th><th width="117.765625">Protocol</th><th>Destination</th></tr></thead><tbody><tr><td>4505</td><td>TCP</td><td>salt.voltmasters.libaro.io</td></tr><tr><td>4506</td><td>TCP</td><td>salt.voltmasters.libaro.io</td></tr><tr><td>8883</td><td>TCP</td><td>AWS IoT (*-ats.iot.eu-west-1.amazonaws.com)</td></tr><tr><td>2984</td><td>TCP</td><td>tmate.voltmasters.libaro.io</td></tr><tr><td>443</td><td>TCP</td><td>*.voltmasters.be</td></tr><tr><td>8086</td><td>TCP</td><td>*.timestream-influxdb.eu-west-1.on.aws</td></tr><tr><td>80</td><td>TCP</td><td>archive.ubuntu.com, security.ubuntu.com</td></tr><tr><td>53</td><td>UDP/TCP</td><td>any</td></tr><tr><td>123</td><td>TCP</td><td>any</td></tr><tr><td>41641</td><td>TCP</td><td>any</td></tr><tr><td>3478</td><td>TCP</td><td>any</td></tr></tbody></table>

### Domains that must be reachable

If the site uses DNS filtering, a web/URL filter, or a next-gen firewall (FortiGate/FortiGuard, Cisco Umbrella, Palo Alto, Zscaler, …), explicitly allow these domains.

* salt.voltmasters.libaro.io
* platform.voltmasters.be (production) / voltmasters-beta.libaro.io (dev units)
* tmate.voltmasters.libaro.io
* tempo.voltmasters.libaro.io
* \*.amazonaws.com and \*.on.aws (AWS IoT, container registry/ECR, InfluxDB)
* archive.ubuntu.com, security.ubuntu.com
* \*.tailscale.com<br>

### How to verify

Run these checks from a laptop on the same network or VLAN as the controller:

```powershell
# 1. DNS must return our real server IP, not a filtered/sinkhole address

Resolve-DnsName tmate.voltmasters.libaro.io

Resolve-DnsName salt.voltmasters.libaro.io

# -> both should resolve to a Voltmasters/AWS IP (e.g. 52.17.81.98),

# NOT to an IP owned by your firewall vendor (Fortinet, Cisco, etc.)

# 2. The ports must be reachable

Test-NetConnection salt.voltmasters.libaro.io -Port 4505

Test-NetConnection tmate.voltmasters.libaro.io -Port 2984

# -> TcpTestSucceeded : True
```

{% hint style="warning" %}
If `Resolve-DnsName` returns an IP that belongs to your firewall or security vendor, the domain is being sinkholed. Allow-list the domain on the firewall.
{% endhint %}

### Linking to an EMS account

A code is printed on the controller. When creating [**a new project**](https://platform.voltmasters.be/projects), enter this code as the Controller ID.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.voltmasters.io/getting-started/ems-controller-installation/internet-and-network.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.