Internet and network

The controller manages your installation (battery, inverter, etc.) and communicates with both the Voltmasters platform and your on-site equipment. Most communication is outbound: the controller "calls out" to the cloud and to your devices. You do not need to open any inbound ports from the internet for normal operation. Remote support reaches the controller over outbound connections only (see Remote support).

Requirements

• Wired network connection (Ethernet) at the location where the controller is installed.

• We prefer DHCP configuration. If you need a static IP, you need to configure this in the network configuration.

• Stable internet connection.

• Access to the same local network (LAN) as your energy devices (inverter, battery controller, meter, etc.).

• Functional DNS and the Voltmasters domains must not be blocked by DNS/content filtering (see DNS & content filtering)

• Accurate clock / NTP time sync allowed (outbound UDP 123). Required, otherwise TLS connections fail.

• No TLS-intercepting (man-in-the-middle) proxy on the controller's traffic.

Outbound ports

Allow the following outbound connections from the controller to the internet:

port	Protocol	Destination
4505	TCP	salt.voltmasters.libaro.io
4506	TCP	salt.voltmasters.libaro.io
8883	TCP	AWS IoT (*-ats.iot.eu-west-1.amazonaws.com)
2984	TCP	tmate.voltmasters.libaro.io
443	TCP	*.voltmasters.be
8086	TCP	*.timestream-influxdb.eu-west-1.on.aws
80	TCP	archive.ubuntu.com, security.ubuntu.com
53	UDP/TCP	any
123	TCP	any
41641	TCP	any
3478	TCP	any

Domains that must be reachable

If the site uses DNS filtering, a web/URL filter, or a next-gen firewall (FortiGate/FortiGuard, Cisco Umbrella, Palo Alto, Zscaler, …), explicitly allow these domains.

• salt.voltmasters.libaro.io

• platform.voltmasters.be (production) / voltmasters-beta.libaro.io (dev units)

• tmate.voltmasters.libaro.io

• tempo.voltmasters.libaro.io

• *.amazonaws.com and *.on.aws (AWS IoT, container registry/ECR, InfluxDB)

• archive.ubuntu.com, security.ubuntu.com

• *.tailscale.com

How to verify

Run these checks from a laptop on the same network or VLAN as the controller:

# 1. DNS must return our real server IP, not a filtered/sinkhole address

Resolve-DnsName tmate.voltmasters.libaro.io

Resolve-DnsName salt.voltmasters.libaro.io

# -> both should resolve to a Voltmasters/AWS IP (e.g. 52.17.81.98),

# NOT to an IP owned by your firewall vendor (Fortinet, Cisco, etc.)

# 2. The ports must be reachable

Test-NetConnection salt.voltmasters.libaro.io -Port 4505

Test-NetConnection tmate.voltmasters.libaro.io -Port 2984

# -> TcpTestSucceeded : True

If Resolve-DnsName returns an IP that belongs to your firewall or security vendor, the domain is being sinkholed. Allow-list the domain on the firewall.

Linking to an EMS account

A code is printed on the controller. When creating a new project, enter this code as the Controller ID.