Firewall and Network Requirements

What is this?

This guide provides the network endpoints, domains, and ports that Margin Master requires for full functionality. Share this document with your IT team or network administrator so they can configure firewalls, proxy servers, and security appliances to allow the application to operate correctly.

Quick Reference

If your IT team just needs the essentials, here is the minimum set of rules required for Margin Master to function:

Detailed Endpoint Descriptions

Application Server

Margin Master communicates with the Margin Master application server for license validation, issue reporting, support services, version checks, and cloud data synchronization.

Primary endpoint:

• Host: www.marginmaster.com
• Port: 443 (HTTPS)
• Protocol: TLS 1.2 or higher

Fallback endpoint (used automatically if the primary domain is unreachable):

• Host: marginmastercom-ebe7ezgsfka0gyar.northcentralus-01.azurewebsites.net
• Port: 443 (HTTPS)
• Protocol: TLS 1.2 or higher

Note: The fallback endpoint is an Azure App Service direct URL. The application tries the primary domain first and only falls back to this address if the primary is unavailable.

Azure Blob Storage

Margin Master uses Azure Blob Storage for automatic updates, database backups, support file uploads, and file downloads.

Auto-updates and downloads:

• Host: retailersoft.blob.core.windows.net
• Port: 443 (HTTPS)
• Containers accessed: marginmasterautoupdate, marginmasterdownloads, issue-attachments, mmsupportdata

Database backups:

• Host: marginmaster.blob.core.windows.net
• Port: 443 (HTTPS)
• Containers accessed: Store-specific backup containers

Azure SQL Database

Margin Master connects to an Azure-hosted SQL Server database for cloud vendor data synchronization (e.g., Ace Hardware catalog and zone pricing data).

• Host: qsriq24mud.database.windows.net
• Port: 1433 (TCP)
• Protocol: TDS over TLS
• Direction: Outbound from client

Note: Azure SQL may also require outbound access to the Azure SQL Gateway IP ranges for your region. See Microsoft's Azure SQL connectivity documentation for details.

Microsoft Downloads (First-Time Installation Only)

During initial setup, Margin Master may download and install SQL Server Express and the Access Database Engine if they are not already present on the machine.

These are only needed during the first installation and can be removed from allowlists afterward if desired.

Internet Connectivity Check

Margin Master performs a lightweight connectivity check on startup to determine whether the machine has internet access.

• Host: www.google.com
• Port: 80 (HTTP)
• Purpose: Connectivity detection only (no data is transmitted)

If this check is blocked, the application may incorrectly report that no internet connection is available. This can affect features that require online connectivity.

Do It Best EDI (Vendor-Specific)

Stores that use the Do It Best vendor integration for EDI mailbox downloads require access to the following FTP endpoint:

• Host: ftp.edi.doitbestcorp.com
• Port: 21 (FTP) or 990 (FTPS with Explicit SSL)
• Protocol: FTP with SSL/TLS

Note: This endpoint is only required for stores that participate in Do It Best EDI data exchange. Most stores do not need this rule.

Port Summary

Multi-PC stores (inbound rules)

Everything above this section is outbound traffic to the internet, which is all a single-PC store needs. The last two rows apply only when a store runs Margin Master on more than one computer against a shared database: the PC holding the database has to accept inbound connections from the others.

Those rules should be scoped to the Domain and Private profiles and never exposed to the internet. The rules, and the rest of the host-side configuration (Mixed Mode authentication, TCP/IP, SQL Server Browser), are laid out step by step for your IT team in SQL Server Authentication Setup for IT Administrators.

Proxy Server Configuration

If your network uses a proxy server, ensure the proxy allows HTTPS traffic to the domains listed above. Margin Master uses standard .NET HttpClient for web requests, which respects the system proxy settings configured in Windows.

To configure a proxy:

1. Open Windows Settings > Network & Internet > Proxy
2. Configure your proxy address and any bypass rules
3. Ensure *.marginmaster.com, *.blob.core.windows.net, and *.database.windows.net are not blocked

TLS Requirements

All HTTPS connections require TLS 1.2 or higher. Ensure your firewall or proxy does not downgrade TLS connections or block TLS 1.2+ handshakes.

Troubleshooting

Application cannot validate license

• Verify that www.marginmaster.com on port 443 is reachable from the machine
• Check that TLS 1.2 is enabled in your firewall/proxy
• Try accessing https://www.marginmaster.com/api/APIAvailable in a browser on the same machine

Auto-updates are not downloading

• Verify that retailersoft.blob.core.windows.net on port 443 is reachable
• Check for SSL inspection tools that may interfere with Azure Blob Storage certificates

Cloud vendor data is not syncing

• Verify that qsriq24mud.database.windows.net on port 1433 is reachable
• Some firewalls block non-HTTP outbound traffic by default — ensure port 1433 TCP outbound is allowed
• Azure SQL requires the Azure SQL Gateway IP addresses for your region

Internet connectivity shown as unavailable

• Verify that www.google.com on port 80 is reachable
• Some corporate firewalls block outbound HTTP (port 80) — consider allowing this for connectivity detection