Skip to main content
Marshall Pro (Fuel) supports the VPOS Media-5 terminal alongside forecourt controllers. Before you deploy any Marshall Pro hardware, your network team must open the following ports, domains, and IP ranges for outbound traffic to Nayax’s cloud.

​
Network prerequisites

A DHCP connection gives Marshall Pro terminals plug-and-play network access, and Nayax recommends it over a static IP assignment. If your network requires a static IP, provide Nayax with the following details before deployment:
  • IP address
  • Ethernet gateway address
  • DNS address
  • Ethernet subnet mask
Static IP configuration requires coordination with Nayax support. DNS resolution is mandatory for all Nayax device communication; blocking DNS prevents the terminal from reaching Nayax entirely.
Nayax Android-based devices use Google Public DNS (8.8.8.8). This address must be reachable from your network.

​
Registered IP ranges

As an alternative to whitelisting individual domains, you can whitelist the full Nayax registered IP ranges. The table below lists global ranges that cover all regions, plus narrower per-country ranges for Israel, Germany, and the United States.
The Israel, Germany, and United States ranges are subsets of the 185.159.232.0/22 global range. Whitelisting that global range alone already covers all three; you don’t need to add the country-specific rows separately unless your firewall policy requires narrower rules.

​
Required ports

Open the following ports for outbound traffic from the Marshall Pro network.

​
Required domains

Add the following domains to your firewall or proxy’s allowlist. Wildcard entries (*.domain) cover all subdomains.

​
Core domains

These domains are mandatory for all Marshall Pro deployments.

​
DCS access URLs

The Nayax Device Control System (DCS) requires the following URLs to be reachable for browsing and use:
  • il1.nayax.net (port 443)
  • il2.nayax.net (port 443)
  • backup.nayax.net (port 443)
  • boot.nayax.net (port 443)

​
Third-party service domains

These domains support certificate validation, security checks, and cloud storage that Nayax services use:
  • s3.amazonaws.com
  • s3.eu-central-1.amazonaws.com
  • seal.verisign.com
  • www.verisign.com
  • extended-validation-ssl.verisign.com
  • trustsealinfo.verisign.com

​
VPOS Media-5 (Castles Technology)

VPOS Media-5 uses a separate terminal management system (TMS) from Castles Technology for application deployment, firmware updates, and remote configuration. Deploying VPOS Media-5 on Marshall Pro requires the Castles TMS domains below, in addition to the core requirements above.

​
Castles TMS domains

The following Castles TMS domains handle application, firmware, and configuration delivery for VPOS Media-5.

​
Connectivity checklist

Use this checklist to confirm you’ve whitelisted everything a VPOS Media-5 deployment needs, combining the Castles TMS domains above with the core requirements earlier on this page:
  • All ports and domains in Required Ports and Required Domains above
  • All Castles TMS domains above
  • The HawkBit OTA update server (hawkbit-vposm-prod.nayax.com, port 443), which every VPOS device needs
  • If you’re deploying in Israel, also whitelist the Israel-based deployment addresses below
If you don’t whitelist the Castles TMS domains and the HawkBit OTA server (hawkbit-vposm-prod.nayax.com), VPOS Media-5 devices can’t receive software updates, security patches, or configuration changes.

​
Israel-based deployments

This section applies only to deployments in Israel. It lists additional addresses to whitelist for payment processing and local service connectivity.
The Shva EMV address is mandatory for all card-present transactions that go through the Israeli payment network. Without it, card-present transactions fail.

​
Remote support (optional)

For remote technical support sessions, Nayax may need TeamViewer access.

​
Important notes

These notes apply across every Marshall Pro deployment, regardless of device or region:
  • All connections are outbound from Marshall Pro devices to the Nayax Cloud; no inbound firewall rules are required.
  • If your network uses a web proxy, add the domains listed above to its bypass list.
  • IP addresses and domains on this page are subject to change; Nayax notifies customers of any updates.

​
See also