NomidPurpose
This guide lists the addresses and ports the company network must allow so that computers can use the Portal and Remote Access, and so that Android tablets stay managed and reachable for remote sessions. Use it to configure firewalls, proxies and content filters before deploying devices, or when Remote Access fails to connect.
All rules in this guide are outbound, with reply traffic allowed. No inbound port needs to be opened on the company network.
Before you start
- Configure rules by domain name (FQDN). Server IP addresses can change; the names in this guide stay stable.
- Make sure the firewall resolves names through public DNS or the same DNS the computers and tablets use.
- Wildcards such as
*.nomid.techusually work only for HTTPS on port 443, because the firewall identifies the destination by the site name inside the secure connection. For every other port, create rules with the exact names listed below. - Keep separate rules per network when computers and tablets are on different VLANs or zones.
Warning: Firewall rule changes affect every device on the network. Apply them to a pilot network or group first, validate a Remote Access session, and only then extend them to the whole company. To roll back, disable the new rules.
Computers (Portal and Remote Access)
Portal
| Destination | Port and protocol | Used for |
|---|---|---|
portal.nomid.tech |
TCP 443 | Portal |
api.nomid.tech |
TCP 443 | Portal services |
nomidtech.firebaseapp.com |
TCP 443 | Sign-in |
identitytoolkit.googleapis.com, securetoken.googleapis.com, firebaseappcheck.googleapis.com |
TCP 443 | Sign-in and keeping the session active |
www.google.com, www.gstatic.com |
TCP 443 | Sign-in security check |
apis.google.com |
TCP 443 | Google sign-in and Managed Google Play app selection |
nomid-store.s3.us-east-1.amazonaws.com, nomid-store.s3.amazonaws.com, nomid-uploads.s3.us-east-1.amazonaws.com |
TCP 443 | File uploads and downloads, icons, wallpapers and screenshots |
If the company signs in with Google or Microsoft, also allow accounts.google.com or login.microsoftonline.com (TCP 443).
Remote Access
| Destination | Port and protocol | Used for |
|---|---|---|
remote.nomid.tech |
TCP 21130 and 21131 | Session setup and relay |
turn-eu.nomid.tech |
TCP 443, 3478 and 21131; UDP 3478 | Relay for tablets in Europe |
turn-us.nomid.tech |
TCP and UDP 3479 | Video relay |
The relay server is chosen from the location of the tablet being accessed, not the computer. Tablets in European countries use turn-eu.nomid.tech, with remote.nomid.tech and turn-us.nomid.tech as fallbacks; all other tablets use remote.nomid.tech and turn-us.nomid.tech. If the company has no tablets in Europe, turn-eu.nomid.tech can be left out; for mixed fleets, allow all of them.
Recommended: UDP 49152–65535 to turn-eu.nomid.tech and turn-us.nomid.tech. These ports allow a more direct video path. Without them, the session usually continues through the relay, but the firewall logs show blocked attempts to these ports.
Optional features
Blocking these destinations affects only the feature listed.
| Destination | Port and protocol | Affected feature |
|---|---|---|
chat.nomid.tech |
TCP 443 | Live support chat |
play.google.com |
TCP 443 | Managed Google Play app selection in policies |
api.mapbox.com, maps.googleapis.com, maps.gstatic.com |
TCP 443 | Maps and device location |
js.stripe.com, api.stripe.com, m.stripe.network, hooks.stripe.com |
TCP 443 | Adding and updating a payment method |
dlq8mrdwspxy1.cloudfront.net |
TCP 443 | Downloading Nomid Store APKs from the Portal |
cdn-nomid.s3.amazonaws.com |
TCP 443 | Company logos and branding |
play-lh.googleusercontent.com, lh3.googleusercontent.com |
TCP 443 | Popular app icons and Google profile photo |
fonts.googleapis.com, fonts.gstatic.com |
TCP 443 | Portal fonts; without them the browser uses system fonts |
Portal usage statistics and telemetry requests can be blocked without affecting any feature.
Tablets (Wi-Fi network)
Management
| Destination | Port and protocol | Used for |
|---|---|---|
api.nomid.tech |
TCP 443 | Communication between the Settings app, Nomid Remote and Nomid |
dlq8mrdwspxy1.cloudfront.net |
TCP 443 | Private app installs and file sync |
nomid-store.s3.us-east-1.amazonaws.com, nomid-store.s3.amazonaws.com |
TCP 443 | Contacts, icons, wallpapers and screenshots |
| Google Android Enterprise services | Per the official list | Android management, Google Play and notifications |
Google's official list is at Android Enterprise network requirements. It includes the push notifications used to deliver commands to tablets; without them, commands such as lock, sync policy and request location do not arrive.
Remote Access
| Destination | Port and protocol | Used for |
|---|---|---|
remote.nomid.tech |
UDP 21116 | Tablet registration; decides whether it shows as online for Remote Access |
remote.nomid.tech |
TCP 21116 and 21117 | Session setup and relay |
remote.nomid.tech |
TCP 21115 | Network type (NAT) test |
turn-eu.nomid.tech |
TCP 443, 3478 and 21117; UDP 3478 | Relay for tablets in Europe |
turn-us.nomid.tech |
TCP and UDP 3479 | Video relay |
Relay server selection follows the same rule as for computers: tablets in Europe use turn-eu.nomid.tech, with remote.nomid.tech and turn-us.nomid.tech as fallbacks.
Recommended: UDP 49152–65535 to turn-eu.nomid.tech and turn-us.nomid.tech, for the same reason described for computers.
Optional features
| Destination | Port and protocol | Affected feature |
|---|---|---|
app-settings.nomid.tech and the company's identity provider (for example, accounts.google.com or login.microsoftonline.com) |
TCP 443 | SSO sign-in on the tablet |
Firewall recommendations
- SSL/TLS inspection: exclude
api.nomid.tech,remote.nomid.tech,turn-eu.nomid.techandturn-us.nomid.techfrom inspection. The Settings app verifies theapi.nomid.techcertificate; with inspection, tablets stop communicating with Nomid. Inspection also breaks the secure Remote Access connections. - UDP timeout: short timeouts stop the tablet from receiving session requests. Use an idle timeout of at least 2 minutes for UDP 21116, 3478 and 3479.
- Rule order: place the new rules above any generic block rule.
- Restricted UDP range: open the UDP 49152–65535 range only to
turn-eu.nomid.techandturn-us.nomid.tech, not to other destinations.
Validate the configuration
- In the Portal, open Devices and confirm the tablet shows as online and synced.
- Start a Remote Access session from a computer on the configured network.
- Confirm the tablet screen appears and that taps and navigation buttons respond.
- Check the firewall logs during the session and confirm there are no blocks to the required destinations in this guide.
Common problems
The firewall keeps blocking ports that are already allowed
Check whether the rule uses a wildcard such as *.nomid.tech. For ports other than 443, create objects with the exact names, for example turn-eu.nomid.tech. Also confirm the rule order, the direction (outbound) and the source network.
The tablet shows as offline for Remote Access
First confirm UDP 21116 to remote.nomid.tech on the tablets' Wi-Fi network and the recommended UDP timeout. Then confirm TCP 21115–21117 to the same destination.
The session opens but drops or is slow
Confirm the relay ports for the server used by the tablet's region: TCP 21131 (computers) and TCP 21117 (tablets) to remote.nomid.tech and, in Europe, to turn-eu.nomid.tech; TCP and UDP 3478 to turn-eu.nomid.tech and 3479 to turn-us.nomid.tech. Exclude the servers from SSL/TLS inspection.
The logs show blocks on high UDP ports
Blocks to turn-eu.nomid.tech or turn-us.nomid.tech on UDP ports between 49152 and 65535 belong to the recommended video path. Allow that range to those two destinations to clear the blocks and make sessions smoother.
The Portal does not finish signing in
Confirm the sign-in destinations in the Portal table and, if the company uses SSO, accounts.google.com or login.microsoftonline.com.
If the problem continues, send support the approximate time with time zone, the device, and the firewall log lines that show the block (destination, port and protocol).