Kiosk
Network Architecture Guide
Reference guide for IT and network teams — firewall allowlists, DNS and bandwidth requirements, local network rules, cloud security, and the site readiness checklist for Mashgin kiosks.
📋 Overview
This guide covers the network architecture and requirements for Mashgin kiosks — firewall allowlists, DNS, local network rules, bandwidth requirements, and cloud security. Share it with your IT or network team when preparing a site.
Every Mashgin kiosk connects to Mashgin's AWS cloud through an encrypted VPN. To bring a kiosk online, the site network must allow traffic to Mashgin's VPN servers and meet the local network requirements described below.
🧱 Firewall Settings
In your firewall settings, ensure that the following addresses are allowed.
No data is passed across ports 80 and 443, but they are required so the kiosk can check which Mashgin servers are reachable from the current network.
Mashgin VPN Servers
Make sure the following IPs are allowed for the Mashgin kiosk:
34.217.245.110
34.211.32.229
52.34.239.216
54.187.226.201
100.21.238.121
Make sure the following ports are allowed for the Mashgin kiosk:
- Port
80— Protocol: TCP+UDP
- Port
443— Protocol: TCP+UDP
Do not select the default HTTP (port 80) / HTTPS (port 443) templates on the router or firewall — they usually default to TCP only, and the Mashgin VPN needs both TCP and UDP protocols.
DNS Requirements
nameserver 1.1.1.1
nameserver 8.8.8.8
Backend (API Integrations)
If your integration requires the Mashgin API to make calls directly to your API and a whitelist is required, the public IPs are:
52.33.212.139(refund endpoint — needed for services such as CBORD)
54.185.78.63
Mashgin Web Services
Domains:
cloud.mashgin.com
IPs:
172.67.73.173
104.26.10.213
104.26.11.213
🏠 Local Network Requirements
All devices running Mashgin software must be on the same Local Area Network and subnet.
Local kiosk security:
- All kiosks are Ubuntu OS password protected.
- Ubuntu Firewall is installed on all kiosks, allowing incoming/outgoing traffic only on specific ports.
- Access to the Ubuntu desktop is disabled for the active account.
☁️ Cloud Network Architecture
Cloud Security
- Encryption — All traffic is passed through Mashgin's VPN, which is ChaCha20 encrypted (see the WireGuard protocols page for more information). Within this, all traffic is SSL (TLSv1.2, TLSv1.3) encrypted. At rest, data is encrypted with Amazon RDS encryption (AES-256).
- Access — Access to the VPN is protected by rotating private key files on each kiosk, held only by certain Mashgin employees. All publicly accessible servers are SSL encrypted and require Mashgin-authorized credentials. Mashgin users are MFA-authenticated through Okta on a 2-hour timeout.
Publicly Accessible Sites
- cloud.mashgin.com — Basic item management and reporting for location managers. Requires a Mashgin or client-provided user account. User accounts and permissions are managed and controlled at the client level. Mashgin users are MFA-authenticated through Okta on a 2-hour timeout; non-Mashgin users are on a 24-hour timeout.
- creator.mashgin.com — Advanced menu management for FSDs and Enterprise-level clients. Same user account system as cloud.mashgin.com.
- my.mashgin.com — Publicly accessible platform for getting transaction receipts. A receipt can only be obtained with its unique transaction hash.
- graph.mashgin.com — Enterprise-level data API. Requires a Mashgin-provided API token.
✅ Site Readiness Checklist
Please provide the following information to Mashgin before installation:
- Will the site be using static IPs or DHCP?
- The range of IPs available, gateway, DNS, and subnet mask
- Confirm assigned ports for kiosks and card readers are configured to the same VLAN
- Are there any restrictions on the number of devices that can be connected to one port?
- Verify that UDP traffic is allowed in both directions on the firewall
- Are there any unique or specific security configurations we should be aware of? (e.g., a periodically refreshed network that reassigns IPs)
❓ Network & Security FAQ
What are the bandwidth requirements?
The Mashgin kiosks can operate on a typical DSL or High Speed Internet line of 3 Mbps or higher down, and 1 Mbps up. Each transaction uploads about 150–200 kB of data on average — so 1,000 transactions will transfer around 170 MB, about the same as 10 minutes of Netflix or YouTube video.
If your implementation requires realtime pricing updates from a 3rd-party system, the requirement becomes no lower than 5 Mbps (download) / 3 Mbps (upload) to avoid timeouts. Persistent connectivity with less than 200 ms latency is key for these circuits, so a high-availability (HA) SLA from the ISP will also impact the overall experience.
Kiosk minimum requirements per device:
- Upload — 1 Mbps (3 Mbps required for realtime pricing updates via 3rd-party integration)
- Download — 3 Mbps (5 Mbps required for realtime pricing updates via 3rd-party integration)
- Latency — N/A (<200 ms required for realtime pricing updates via 3rd-party integration)
How does Mashgin remotely connect to the kiosks?
- Mashgin has remote access to each kiosk through a secured connection.
- Through this connection, Mashgin can update, patch, and monitor each kiosk as long as it maintains a network connection.
- Only authorized Mashgin employees have access to the remote connection.
How often are remote-access credentials, keys, and certificates rotated?
Credentials for clients are rotated on a daily basis.
What SSL certificate authority is used?
Our certificates are validated by Let's Encrypt, an open Certificate Authority.
What VPN client is being used?
We use WireGuard hosted on Amazon Web Services. All usage data passes from the Mashgin kiosk to the AWS cloud only over the VPN connection.
Who is your data provider and where are they located?
We use Amazon Web Services (AWS). The primary data center we use is located in AWS's Oregon region.
What pieces of data do you store, and for how long?
- Tenders — Payment method, payment status, amount charged, card or tender type, cardholder name (as returned by the payment gateway), cardholder number (gateway-truncated to first 6 and last 4 digits), auth code, and request ID for the payment.
- Transactions — Timestamps, total amount, taxes & discounts.
- Items — Name, weight (if applicable), options & modifiers, discounts, base item price, charged item price, sales tax.
- Images — 1 camera overhead image per transaction.
All of the above transaction data (except images) is stored indefinitely. Transaction snapshot images are stored for 3 months.
Do you back up your Cloud data?
Our database is automatically backed up multiple times daily, with backups stored for 1 month.
Visit trust.mashgin.com for the live status of Mashgin's organization controls, as well as our security and compliance documentation — including our most current SOC 2 reports.
🔗 Related Articles
Need help? Contact support at 📧 help@mashgin.com or call (855) 475-0889