Set up network requirements for Square hardware
About networking requirements for Square hardware
In most cases, Square hardware is easy to connect to the internet and use straight out of the box. However, if your business has a more complex networking setup, you may want to check Square’s networking requirements to optimize the performance of your Square hardware.
Before you begin
The following requirements typically apply to businesses with more complex internet network setups. We recommend only making changes to your network configuration if you are knowledgeable about network requirements, or working with a professional.
Keep in mind, you are able to connect your Square Handheld, Terminal, Register, and Kiosk to a private network or an unsecured network, but you won't be able to connect to a captive portal network. A captive portal is a network that requires you to agree to terms or conditions to access the internet connection (these networks are common at coffee shops, airports, convention centers, and other public internet access points).
Protocol/port allowlist
If you enforce restrictions on what protocols and ports that devices on your network can access, Square devices require the following protocols and their corresponding ports to be allowed through your firewall:
NTP: This is critical for ensuring that the device has the correct time. Connectivity may fail due to certificate validity mismatches if the device time is wrong.
HTTPS (only port 443): All traffic to Square servers is made over HTTPS.
The following ports are also used for network printers, but these do not require access to the internet:
UDP: 22222, 3289
TCP: 9100:9109
Domain filtering
If you enforce restrictions on what domains can be accessed from within your network, Square devices require the following domains to be allowlisted.
All subdomains of:
- squareup.com
- issquareup.com
- squareup1.com
- squareup2.com
- squarecdn.com
- cash.me
- Cash.app
- sqaddons.com
- health.afterpay.com
As well as the following FQDNs:
- api.skyhookwireless.com
- global.skyhookwireless.com
- notify.bugsnag.com
- sessions.bugsnag.com
- apytiqcuyrsq6-ats.iot.us-east-2.amazonaws.com
- square.site
- www.weebly.com
- api.mapbox.com
- mobile-data.onetrust.io
- privacyportal.onetrust.com
- cdn.cookielaw.org
- d1g145x70srn7h.cloudfront.net
- d1gbdwzqwul952.cloudfront.net
- d22lvmw6m6nbct.cloudfront.net
- d2giyu7blljsiv.cloudfront.net
- d2isyty7gbnm74.cloudfront.net
- d3eak51ol1qdx0.cloudfront.net
- d3g64w74of3jgu.cloudfront.net
- d3puw3phxc2c50.cloudfront.net
- d6o4e37k0f0rr.cloudfront.net
- dc9mvqbb8vj5.cloudfront.net
- djsijjdm01rhs.cloudfront.net
- dl6rt3mwcjzxg.cloudfront.net
- cml-production-public-us-west-2.s3-us-west-2.amazonaws.com
- browser-intake-datadoghq.com
- browser-intake-datadoghq.eu
- us3.datadog.com
- us5.datadog.com
- maps.googleapis.com
- checkout.square.site
- square.link
- cdn2.editmysite.com
- cdn3.editmysite.com
- square.online
- www.square.online
- items-images-production.s3.us-west-2.amazonaws.com
- square-production.s3.amazonaws.com
- api.bitdrift.io
- connectivitycheck.gstatic.com
- tsock.us1.twilio.com
- mercury-attachments-production-us-west-2.s3.us-west-2.amazonaws.com
As well as the following FQDNs, if in Canada:
- api.rq-fo.ca
- cnfr.api.rq-fo.ca
- certificats.api.rq-fo.ca
- certificats.cnfr.api.rq-fo.ca
- qr.mev-web.ca
- cnfr.qr.mev-web.ca
NTP requires access to:
- time.android.com
- 0.datadog.pool.ntp.org
- 1.datadog.pool.ntp.org
- 2.datadog.pool.ntp.org
- 3.datadog.pool.ntp.org
IP addresses
- US: 74.122.184.0/21
- Asia/Pacific: 103.31.216.0/22
- Europe: 185.57.56.0/22
Square devices also rely on access to Amazon Web Services (AWS) and Google Cloud Platform (GCP). AWS IP ranges are published here, and Google is AS15169. Make sure to add these IP ranges as well.
Square devices have an internal firewall and an internal (domain, not IP) allowlist, and perform TLS certificate pinning on all Square endpoints, so you may consider the IP allowlisting on your side redundant depending on your purpose. It could make sense to just ensure Square devices can’t access any internal company IP addresses, and leave the rest of the internet open for Square’s on-device firewall and domain filter.
MAC addresses
Square’s MAC OUI: 44:59:25
Sellers should allowlist all MAC addresses that start with the above prefix (i.e., devices with MAC addresses following the pattern 44:59:25:XX:XX:XX). Alternatively, sellers can allowlist each individual device that shows up with that MAC address prefix (this prefix is owned by Square and should not be used by any other device vendors).
If you have older Square hardware, you may need to also allowlist the following MAC prefixes:
Older MAC OUIs: 2C:D1:41:D, 8C:47:6E:5, 1C:59:74:6
Square devices are compatible with any DNS server sent to the device over DHCP as long as it works. Feel free to use your ISP’s servers, or your favorite public servers (e.g. Level3 at 4.2.2.1/4.2.2.2).
Do not block Google and Cloudflare IPv4 and IPv6 DNS + DNS64 addresses on the network.
- 1.1.1.1 — Cloudflare DNS
- 8.8.8.8 — Google DNS
- 2606:4700:4700::1111 — Cloudflare IPv6 DNS
- 2001:4860:4860::8888 — Google IPv6 DNS
Square Terminal and Square Register (1st generation) support:
- WPA2 Personal
- WPA2 Enterprise (username + password)
- WEP (US only)
Square Terminal and Square Register (1st generation) do not support:
- WPA2 Enterprise (certificate-based)
- WPA3 Enterprise (username + password)
- WPA3 Enterprise (certificate-based)
Square Handheld, Square Register (2nd generation), and Square Kiosk support:
- WPA2 Personal
- WPA2 Enterprise (username + password)
- WPA3 Personal
- WPA3 Enterprise (username + password)
- WEP (US only)
Square Handheld, Square Register (2nd generation), and Square Kiosk do not support:
- WPA2 Enterprise (certificate-based)
- WPA3 Enterprise (certificate-based)