IP addresses and firewall rules

Distinguish your octoja website’s IP addresses from outbound connections to integrations and SMTP servers.

The address you need to allow in a firewall depends on who connects to which destination. Your octoja website's IP addresses and the source IPs of outbound connections are not the same.

Distinguish the connection directions

Connection	Destination	Which rule matters?
Browser or agent → octoja	Your octoja instance's hostname	The firewall in the browser's or device's network must allow access to octoja.
octoja → integration, such as c-entron	The API address configured in the integration	The firewall in front of the API must allow requests from octoja on the API's port.
octoja → webhook receiver	The configured webhook URL	The firewall in front of the receiver must allow deliveries from octoja on the URL's port.
octoja → custom SMTP server	The configured SMTP host and port	The firewall in front of the mail server and, where applicable, its relay rules must allow delivery from octoja.

A DNS lookup of your octoja website returns destination addresses for accessing octoja. It does not tell you which source IPs octoja uses to contact an integration or SMTP server. Opening the provider's website successfully in your browser does not confirm that octoja can reach its API either.

Allow integration and SMTP connections

The platform makes these connections, not the agent on a managed device. A rule in the device's network alone will not help if the firewall in front of the API or SMTP server blocks octoja.

c-entron: The destination is your c-entron web service, not the Service-Board website or your octoja address. octoja calls the web service API over HTTPS. Allow these requests to the host and port in your web service address. For the correct base address, see Connect c-entron Service-Board.
Other API integrations: Use the API endpoint specified in that integration's guide. A firewall in front of it must allow octoja to connect; successful access from your own network is not sufficient as a test.
Webhooks: Allow deliveries from octoja to the host and port of your webhook URL. See Set up webhooks.
Custom SMTP server: Allow octoja to connect to the SMTP host on the configured port. The port and encryption depend on your mail provider, not your octoja website's HTTPS port. See Configure email sender.

Then test the connection in octoja. For SMTP, use Send test email and check that the message arrives.

Ask for the outbound source IP

If your API or SMTP relay only accepts specific source IPs, ask octoja support for the current outbound source IPs for your octoja instance and the connection concerned. Send your octoja instance URL and identify the integration or SMTP server. For a failure, include the error and test time; do not send passwords or API keys.

The outbound source IP can change, for example if your octoja instance moves to another server. If an existing IP rule stops working, check rejected connections in your firewall and confirm the current source IPs with support again.

Warning: Do not use your octoja website's IP addresses as an outbound source-IP allowlist. Do not open the API or SMTP relay to arbitrary senders to bypass a failed test either.

FAQ

Is there a permanently fixed list of outbound IP addresses?

A fixed pool of outbound IP addresses is planned but is not available yet. A source IP currently provided by support is therefore not a guarantee that it will remain unchanged.

Does a custom domain determine the outbound source IP?

No. A custom domain determines the address you use to access octoja. Its CNAME record does not determine the source IP octoja uses to contact an integration or mail server.

Was this helpful?

Still need help? Ask the team