Home
>
Blog

Customer guide: firewall settings — STRIPE

September 4, 2026
by
Bruno Rolim
#
FAQs
#
Features
Customer guide: firewall settings — STRIPE

Omella Firewall Configuration

For school and district IT administrators.

Omella needs outbound HTTPS (TCP 443) to the domains below. There are no inbound rules to open.

Allowlist by domain name, not IP address. The addresses behind these domains change without notice. An IP list will work at first, then fail intermittently.

1. Allowlist

Outbound TCP 443.

# Omella
*.omella.com

# Card payments
*.stripe.com
*.stripecdn.com
*.stripe.network
hcaptcha.com
*.live-payments-api.com
applepay.cdn-apple.com

# Bank account (ACH) payments
*.plaid.com
*.meld.io

# Bot protection
challenges.cloudflare.com

# Images and file attachments
res.cloudinary.com
*.s3.amazonaws.com

# Support chat and in-app messages
app.atlas.so
*.atlas.so
assets.customer.io
track.customer.io
*.customer.io

# Staff sign-in — whichever your organization uses
accounts.google.com
login.microsoftonline.com
*.okta.com

# Cosmetic and analytics — safe to skip
fonts.googleapis.com
fonts.gstatic.com
www.googletagmanager.com
www.google-analytics.com
*.analytics.google.com
region1.google-analytics.com

Also allow WebSocket (wss://) to api.omella.com. If your appliance has an Allow WebSocket / HTTP Upgrade setting, enable it.

Why the payment domains. Card details are captured by a secure field served by the processor and sent from the browser straight to them — they never pass through Omella. Blocking these breaks card entry even though Omella itself loads fine. Allowlist all of them: which processor handles a payment depends on your configuration and the payment method, so partial allowlisting fails unpredictably.
Bank account (ACH) payments. Depending on your configuration, bank linking runs through Plaid, Meld, or Stripe. Stripe's needs no extra domain — it is part of *.stripe.com. All three then redirect to your bank's own website to log in, so a filter that blocks financial institution sites will fail at that step even with every domain above allowed.
Why WebSocket. Omella uses a live connection for form and payment status. Blocked, the page loads but never updates.
Staff sign-in. Omella supports Google, Microsoft Entra (Azure AD), Okta, and generic SAML. Allow the one your organization uses — staff cannot log in without it. If you use Okta, allow your own Okta tenant domain; for generic SAML, allow your identity provider's domain.
Category filters. Omella may be classified as Financial Services, Payments, or Shopping. Allowlisting these domains overrides the category block. Fonts and analytics are genuinely safe to block: pages fall back to a system font and nothing else changes.

2. Do not TLS-inspect these

Add a decryption bypass for:

*.omella.com
*.finix.com
forms.finixpymnts.com
*.live-payments-api.com
*.plaid.com
*.meld.io
challenges.cloudflare.com
Why. Card readers pin certificates and reject a re-signed one — no reader setting overrides this. Decrypting cardholder traffic also pulls your appliance into PCI scope. Interception additionally breaks WebSocket upgrades and can blank out the card entry field.

3. Card readers

Skip this section if you take payments online only.

How a reader reaches the internet:

Stripe Reader M2

  • Connects by: Bluetooth (or USB on Android) to a phone or tablet
  • Needs its own network access: No — uses the paired device's connection

Allow the domains below on whichever network carries the traffic: the phone or tablet's network for the M2.

Outbound TCP 443, in addition to Section 1:

# Stripe reader (M2)
armada.stripe.com
gator.stripe.com
api.emms.bbpos.com
*.terminal-events.stripe.com
stripe-point-of-sale-us-west-2.s3.us-west-2.amazonaws.com

Bluetooth readers (Stripe M2)

These have no network configuration of their own. Instead:

  • The phone or tablet they pair with must reach every domain above, plus Section 1.
  • Keep the reader within Bluetooth range of the paired device.
  • Avoid 2.4 GHz interference — heavy microwave oven use nearby can disrupt Bluetooth.
  • Grant the Omella app Bluetooth permission on the device.

If staff use a guest or student SSID on their phone, apply the same allowlist there — a captive portal will block the reader's traffic even though Bluetooth pairing succeeds.

Note. Stripe reader firmware for the M2 arrives through the paired device, so armada.stripe.com and api.emms.bbpos.com must be reachable from that device's network.

4. Email

  1. Allowlist the Omella sending domain in your mail gateway. Contact support for the exact From and link-tracking domains for your organization.
  2. Do not rewrite links. Safe Links and URL Defense can break one-time payment and signature links.
  3. Deliver to inbox, not quarantine.

Omella mail is authenticated with SPF, DKIM, and DMARC, so allowlisting the sending domain is sufficient — no IP rules needed. Families on personal email need no action.

5. Troubleshooting

First test: put the device on a cellular hotspot. Works there → the cause is on your network. Fails there too → contact support.

Symptom Likely cause Fix
Card field is blank or won't accept input Payment domains are blocked, or TLS inspection is enabled Follow Section 1 and add a TLS bypass
“Payment could not be processed” Payment domains are blocked Follow Section 1
Bank linking fails at the bank login *.plaid.com, *.meld.io, or the financial institution's website is blocked Allow these domains and financial institution websites
The Pay button remains disabled after all card payment information is entered challenges.cloudflare.com is blocked Allow Cloudflare Turnstile
Images and logos are missing res.cloudinary.com is blocked Allow Cloudinary
Attachment upload fails *.s3.amazonaws.com is blocked Allow Amazon S3
Reader shows “Device unreachable” Reader domains are blocked, or TLS inspection is enabled Follow Section 3 and add a TLS bypass
New reader won't activate api.paxstore.us is blocked Allow api.paxstore.us
A800 worked yesterday but fails today The DHCP lease or session timeout is too short Use a full-workday lease and reserve the reader's IP address
Bluetooth reader pairs, but payments fail The paired phone or tablet cannot reach the required domains Apply Sections 1 and 3 to that device's network
Fails only on student or guest Wi-Fi That SSID uses a different network policy Apply the allowlist to every applicable SSID

6. Verify

curl -sS -o /dev/null -w "%{http_code}\n" <https://omella.com>
curl -sS -o /dev/null -w "%{http_code}\n" <https://api.omella.com>
curl -sS -o /dev/null -w "%{http_code}\n" <https://api.stripe.com>
curl -sS -o /dev/null -w "%{http_code}\n" <https://res.cloudinary.com>

Any HTTP status code means you reached the service. A timeout, refused connection, or TLS error means it is blocked.

Check for TLS interception — the issuer should be a public CA, not your appliance:

echo | openssl s_client -connect api.stripe.com:443 -servername api.stripe.com 2>/dev/null | grep -i issuer

In the browser, press F12 and check the Console and Network tabs. ERR_BLOCKED_BY_CLIENT, ERR_CONNECTION_TIMED_OUT, or ERR_CERT_AUTHORITY_INVALID name the blocked hostname directly.

Readers have a built-in diagnostics screen that tests DNS and connectivity.

7. Contact support

Email help@omella.com with:

  • Organization name
  • Error message or screenshot
  • Hotspot test result
  • Affected network/SSID and device type
  • Reader model and serial number, for reader issues
  • Whether TLS inspection is on

Appendix — exact hostnames

If your firewall does not support wildcards.

Omella

omella.com
www.omella.com
app.omella.com
api.omella.com

Stripe

js.stripe.com
api.stripe.com
m.stripe.com
m.stripe.network
q.stripe.com
r.stripe.com
payments.stripe.com
checkout.stripe.com
pay.stripe.com
verify.stripe.com
a.stripecdn.com
b.stripecdn.com
c.stripecdn.com
f.stripecdn.com
hcaptcha.com
Thanks!
An error occurred :/

Keep reading

All articles
➜
Customer Guide: Firewall Settings — FINIX
Omella Firewall Configuration - Finix
Omella now integrates with Skyward®
District payments families actually love. Now built for Skyward districts.
Your Back-to-School Guide
From the first parking permit to the first Friday night game — everything to get set up before the year kicks off.

FAQ

How do I disconnect the card reader?

No-fee Payments, Forms & Signatures

One beautifully simple product, so you can spend time doing what you love.
Try Omella

Trusted by schools just like yours

Created by the founders of
Book a live demo
Try it now
By the founders of
® Omella
By the founders of