This article describes which network allowances must be configured in a corporate network to enable charging stations to successfully connect to the reev backend.
Note: Network allowances are generally only required in corporate networks. In a private home network, no specific firewall rules are needed, and no port forwarding needs to be set up.
Prerequisites
The following prerequisites must be met before configuring the network allowances:
Access to the firewall or network configuration of the corporate network
Administrative rights for the network infrastructure
Knowledge of the charging station models in use (relevant for NTP configuration)
Required Network Allowances
The following ports and protocols must be enabled in the firewall to allow charging stations to establish a stable connection to the reev backend.
1. HTTPS – Port 443/TCP (WebSocket Connection)
The primary connection to the reev backend is established via an encrypted WebSocket connection.
Parameter | Value |
Protocol | TCP |
Port | 443 |
Purpose | Encrypted WebSocket connection to the reev backend (TLS) |
Note: This is the recommended connection method for production use.
2. HTTP – Port 80/TCP (Unencrypted WebSocket Connection)
An unencrypted WebSocket connection without TLS is technically possible.
Parameter | Value |
Protocol | TCP |
Port | 80 |
Purpose | Unencrypted WebSocket connection to the reev backend (without TLS) |
Note: Port 80/TCP is generally intended for testing purposes. Port 443/TCP should be used in production environments.
3. DNS – Port 53/UDP (Name Resolution)
Charging stations require access to a DNS resolver to resolve backend domain names.
Parameter | Value |
Protocol | UDP |
Port | 53 |
Purpose | DNS name resolution |
DNS resolver | Internal corporate resolver or public resolver supported |
Tip: Either an internal corporate DNS resolver or a public service (e.g. 8.8.8.8 by Google or 1.1.1.1 by Cloudflare) can be used.
4. NTP – Port 123/UDP and Port 4460/TCP (Time Synchronisation)
Charging stations require access to NTP servers for time synchronisation. Without a correct system time, connection issues may occur.
Parameter | Value |
Protocol | UDP / TCP |
Port | 123 (UDP), 4460 (TCP) |
Purpose | Time synchronisation of charging stations |
NTP Servers for ABL eM4 Charging Stations
For ABL eM4 charging stations, the following NTP servers are known and must be allowed:
Hostname | IP Address |
ptbtime1.ptb.de | 192.53.103.108 |
ptbtime2.ptb.de | 192.53.103.104 |
ptbtime3.ptb.de | 192.53.103.103 |
ptbtime4.ptb.de | 194.94.95.123 |
Note: For other charging station models, the NTP servers used are manufacturer-dependent and not fully known. Some charging stations allow manual NTP server configuration in their network settings. It is generally recommended to allow outbound connections to NTP servers (port 123/UDP) across the network.
5. IPS/IDS – Disable TLS Inspection for reev Domains
Intrusion Prevention and Detection Systems (IPS/IDS) with TLS inspection can interrupt the WebSocket connection to the reev backend. TLS inspection must be disabled for all reev backend domains.
reev Backend Domains (Allowlist)
The following domains must be excluded from TLS inspection:
Domain | Purpose |
ocpp.reev.com | OCPP connection (charging station ↔ backend) |
io.reev.com | General backend communication |
abl.reev.com | Communication for ABL charging stations |
ems.reev.com | Energy Management System (EMS) |
IP Addresses of the reev Backend Domains
All reev domains listed above are reachable via the following IP addresses:
IP Address |
3.73.150.224 |
35.157.89.149 |
18.153.195.24 |
Note: IP addresses may change as part of infrastructure updates. It is recommended to configure firewall rules primarily based on domain names rather than IP addresses alone.
Summary of Network Allowances
The following table provides an overview of all required allowances:
Protocol | Port | Direction | Purpose |
TCP | 443 | Outbound | WebSocket connection to the reev backend (TLS) |
TCP | 80 | Outbound | WebSocket connection without TLS |
UDP | 53 | Outbound | DNS name resolution |
UDP | 123 | Outbound | NTP time synchronisation |
TCP | 4460 | Outbound | NTP time synchronisation (ABL eM4) |
Troubleshooting
The charging station does not connect to the reev backend
The following steps help with diagnosis:
Check whether port 443/TCP is enabled in the firewall for outbound connections.
Verify that DNS resolution works for the reev backend domains (port 53/UDP).
Check whether IPS/IDS systems are inspecting and interrupting TLS connections to reev domains.
Ensure the charging station has access to an NTP server so that the system time is correctly synchronised.
Review firewall logs for blocked connections to the IP addresses or domains listed above.
The connection drops repeatedly
Check whether an IPS/IDS system is actively inspecting TLS connections to reev domains – this function must be disabled for all reev domains.
Ensure that no firewall timeout rules are prematurely terminating existing WebSocket connections.
Tip: WebSocket connections are long-lived TCP connections. Firewall rules with short idle timeouts can interrupt these connections. An idle timeout of at least 300 seconds is recommended for reev backend domains.
Frequently Asked Questions
Do I need to open ports or set up port forwarding in my home network?
No. In a private home network, no network allowances or port forwarding are required. The configurations described in this article apply exclusively to corporate networks with restrictive firewall rules.
Which ports are mandatory?
For production use, port 443/TCP (outbound) is mandatory. In addition, port 53/UDP (DNS) and port 123/UDP (NTP) are required. Port 80/TCP is optional and intended for testing purposes only.
Why must TLS inspection be disabled for reev domains?
Charging stations establish an encrypted WebSocket connection (WSS) to the reev backend. TLS inspection systems break this end-to-end encryption and can cause the connection to fail or become unstable. All reev backend domains must therefore be excluded from TLS inspection.
What happens if the charging station cannot reach an NTP server?
Without correct time synchronisation, connection issues with the reev backend may occur, as certificates and authentication tokens are time-dependent. It is recommended to allow outbound NTP connections in general.
Can the IP addresses of the reev backend domains change?
Yes. IP addresses may change due to infrastructure updates. Firewall rules should therefore be configured primarily based on domain names rather than IP addresses alone.
Which NTP servers are used by charging stations other than the ABL eM4?
The NTP servers used are manufacturer-dependent. For models other than the ABL eM4, the specific NTP servers are not fully known to us. Some charging stations allow manual NTP server configuration in their network settings. We recommend allowing outbound connections to NTP servers (port 123/UDP) in general.