Scheduled Update – New Outbound Static IP & API Endpoint Consolidation (December 17, 2025)

On December 17th, 2025 between 08:00–10:00 CET, we will deploy a platform update that improves the security, clarity, and stability of API communication between Cloudlabel and customer systems.

1. New Outbound Static IP Address

All outbound API traffic from Cloudlabel will use a new static IP: → New outbound IP: 20.238.117.173

If your organization uses IP allow-listing in firewalls, please ensure this address is permitted.

2. API Domain Migration to api.cloudlabel.com

All API communication will be standardized through: https://api.cloudlabel.com

This improves routing consistency, isolation, and long-term service reliability.

The goal of this update is to:

• increase security and traceability,

• simplify API configuration for customers,

• provide a stable, predictable outbound IP for firewall-restricted environments,

• reduce confusion around historical endpoint usage.

Cloudlabel components communicate using standard and secure outbound HTTPS connections.

Insights below are based on our technical troubleshooting guide for firewall behavior  .

Outbound Traffic

• The Cloudlabel Agent and integrated systems communicate outbound to Cloudlabel over HTTPS on port 443.
• Responses return using the operating system’s ephemeral ports, typically in these ranges:
  • Windows/macOS: 49152–65535
  • Linux: 32768–60999

Because firewalls sometimes misinterpret these return connections as “unexpected inbound traffic,” stateful rules are recommended.

Inbound Traffic

The Cloudlabel Agent accepts true inbound connections only on:

• 27417 – internal agent API
• 2323 – local service UI

No other inbound ports are used by the agent.

To ensure uninterrupted service:

1. Allow Outbound

• TCP 443 → api.cloudlabel.com

2. Allow Inbound (Agent only)

• TCP 27417
• TCP 2323 (typically localhost only)

3. Use Stateful Inspection

Enable ESTABLISHED / RELATED connection tracking so that the agent’s HTTPS responses (via ephemeral ports) are not incorrectly blocked.

This is the most secure and preferred configuration.

4. If Stateful Firewalls Are Not Available

(rare; older systems)

Allow inbound ephemeral port ranges:

• Windows/macOS: 49152–65535
• Linux: 32768–60999

You can verify that agent communication is working by checking the printer icon in the top-right corner of the Cloudlabel Agent.

• If the icon is enabled and white, communication on port 27417 is functioning correctly.
• If the icon appears disabled and grey, the traffic is not working as expected.

• We are introducing a new fixed outbound IP address(20.238.117.173) and consolidating API traffic under api.cloudlabel.com.

• Customers using firewall allow-listing may need to update rules.

• These changes improve transparency, security, and long-term stability of Cloudlabel’s API communications.

If you have questions, contact us at [email protected].