When you make a point of sale transaction, your cash register, terminal, and Adyen will need to be able to communicate with one another. The flow of this communication depends on whether your integration uses local or cloud communications. To enable this communication, you need to configure your network to allow access to specific ports and addresses.
Network communications flow
When you make a transaction, your integration uses one of the following communications flows:
In accordance with PCI-DSS requirements, we use Transport Layer Security (TLS) 1.2 for secure data transmission over the internet.
Configuring your network
To configure your network for point of sale communications:
If you need to whitelist IP addresses, add Adyen's domains to your firewall's whitelist.
Configure your firewall to allow outgoing HTTPS traffic from the IP addresses of your cash registers and terminals to:
Whitelisting should be based on the DNS name of these URLs. Your firewall should dynamically check for IP address updates, at least every 60 seconds.
Do not hard-code Adyen's IP addresses, as these can change over time. We do not share a list of our IP addresses publicly.
Open the ports:
- tcp/443 to the internet.
tcp/8443 on your LAN.
- If your integration uses local communications:
- Ensure that your terminal and cash register are connected to the same local network.
- Protect the communications between your cash register and terminal.
- If you are using a legacy setup where the cash register and terminal communicate over a serial connection, use hardware flow control.
Configuring the terminal IP address
To send payments for online authorisation, a terminal must have a valid IP address configuration. There are several ways to assign an IP address to a terminal:
- Dynamic IP: Your DHCP server issues an IP address to the terminal on the fly.
- DHCP reservation: On the DHCP server, you bind an IP address to the terminal's MAC address. The DHCP server then assigns the exact same IP address to the terminal each time. This is an alternative to using static IP addresses, especially if you're dealing with a large number of terminals.
- Static IP: You enter the IP address and other network configuration details manually on the terminal.
It's not possible to configure an IP address from the Customer Area.
Be aware that you can't use a mix of dynamic and static IPs on a terminal: The IP address of the terminal and the IP addresses of the DNS server and router must be either all dynamic, or all static.
By default, DHCP is enabled on the payment terminal. With this setting, your DHCP server issues an IP address to the terminal, either dynamically or through DHCP reservation if you've set that up.
If it's possible to set the DHCP lease time on the DHCP server, set this to 24 hours or more. The lease time is the time that the terminal keeps an IP address before the DHCP server renews the terminal's lease on the IP address.
In an integration with cloud communications, you should use dynamic IP addresses without DHCP reservation.
- In an integration with local communications, you should either use DHCP reservation, or manually configure static IP addresses.
Defining a static IP address
If you have an integration with local communications and can't use a DHCP server with DHCP reservation, you need to disable DHCP and define a static IP address for the terminal.
- On the connected terminal, open the Admin menu.
Select Network and then, depending on your connection type:
Connection type Select Wired Ethernet. Wireless WiFi > select your Wi-Fi network > IP Settings. Bluetooth Bluetooth > select the external device > IP Settings.
- In IP Settings, clear the Use DHCP check box.
Enter your network details. To type a period (.), press 1 twice. Specify the following:
- IP address of the terminal - this must be unique in the network
- Subnet mask of the network
- IP address of the router
IP addresses of the preferred DNS server and the alternate DNS server
- Select the check mark (or Apply in some cases) to confirm.
General networking recommendations
To prevent network issues from interfering with your point of sale transactions, we recommend that you:
- Use a segmented network, dedicated to point of sale communications.
- Make a DNS server accessible from your local network. This should be able to resolve
If you use a caching name-server, the Time to live (TTL) set by Adyen must be honored (60 seconds for Disaster Recovery).
- Follow our guidelines for IP address configuration.
- If you use intrusion detection (IDS) and prevention systems (IPS), ensure they are using up to date firmware and signatures. If these are out of date, the encrypted communications used by your integration may be disrupted.
- Connect your cash registers and terminals to an uninterrupted power supply (UPS).
Use a cellular backup connection by:
- If the network connection is fine but you are noticing issues with terminals and payments that seem to point to network connection problems, refer to Dropped network packets when the internet connection is available.
If you need more information on configuring your network, contact our POS Support Team.
To connect your payment terminals over Wi-Fi, your access point needs to support:
- WPA/WPA2-Enterprise encryption, or WPA/WPA2-Personal encryption.
- 2.4Ghz or 5Ghz frequencies.
If you use Verifone e285 terminals, your Access Point must support 2.4Ghz channels.
In addition, we recommend that you:
- Configure a remote Wi-Fi profile from your Customer Area, under Point of sale > Terminal settings > Connectivity.
To use Enterprise encryption, using a remote Wi-Fi profile is mandatory.
- Use a dedicated private wireless network.
- If your integration uses local communications, disable the Wireless Isolation, AP Isolation, Client Isolation, or other similar features on your access point.
Note that when the terminal indicates it is connected to your Wi-Fi network, this doesn't necessarily mean that it is connected to the internet. There can be issues with the connection from your Wi-Fi network to the internet.
Using a proxy
Adyen-supplied payment terminals do not support proxy connections. If your network uses a proxy, allow your terminals to bypass the proxy and connect directly to the Adyen payments platform.
Handling loss of internet connectivity
When a transaction is declined because of a network connection issue, the error condition you receive for the transaction is UnreachableHost.
There are several ways you can continue making transactions when your primary internet connection is unavailable. These are:
- Use a 3G/4G failover connection. When your primary internet connection fails, transactions are processed using the cellular connection.
- Enable offline transactions. This will allow you to continue processing transactions when your store has no internet connection.
Offline transactions are only available for integrations that use local communications.
You are fully liable for the risk of failed captures, chargebacks, and disputes related to payments that you process offline.
Using 3G/4G failover
To use a cellular connection as a backup, you can either:
Using 3G/4G terminals
The Verifone V400m and e285 terminals have built-in 3G/4G hardware and pre-installed SIM cards. If your primary internet connection drops, these terminals will automatically switch to processing payments using their cellular 3G or 4G connection. They will also switch back to using your primary internet connection once this is available again.
Many European mobile network operators will discontinue support for 3G from 2020 onwards. If you're located in Europe, you may want to use 4G terminals instead of 3G terminals.
Because there are monthly costs involved with using cellular connectivity on the terminal, you need to sign a subscription contract with Adyen.
To set up cellular connectivity on the terminal:
- Contact our POS Support Team or your Adyen account manager and sign the subscription contract.
- Wait until you receive confirmation that we have activated the terminal's SIM card.
- Enable cellular connectivity on the terminal:
- Open the Admin menu.
- Select Network > Cellular.
- Select the Cellular toggle switch to enable the feature.
The settings are loaded automatically, you don't have to do any further configuration.
Using a 3G/4G router
If your terminals don't have built-in cellular hardware, we recommend installing a router with 3G/4G network failover. To ensure you get the best cellular reception, you should also install external 3G/4G antennas.