Receiving an ARROW Device

Receiving an ARROW Device

This page is for the people at the location where an ARROW device is being installed: the person who unboxes and connects it, and the network or security team that approves its access. It covers what the device needs from the network, how to set it up, and what to check if it does not come online.

No ARROW account is needed, and nothing is installed on any computer at the site.

The card in the box

Every device ships with a card. It lists the VPN address for the engagement and the setup steps. Keep it with the device.

The VPN address is the destination for the device’s tunnel, and every firewall rule below refers to it. It normally takes the form 00000.arrowvpn.io: a five-digit number followed by the domain. Some engagements use a custom address instead. The card shows which applies.

If the card is missing, ask your security provider for the address before the device is installed.

What the device is

The ARROW device is a small appliance that gives your security provider remote access to your network for the duration of an engagement. When powered on, it opens one encrypted tunnel to your security provider’s ARROW platform. All of their work passes through that tunnel.

The device does	The device does not
Make outbound connections only	Need any inbound port, port forward, NAT rule, or public IP
Take an address from DHCP, like any other client	Need software, an agent, or a certificate on any of your computers
Encrypt all traffic in the tunnel (WireGuard and TLS)	Need domain credentials or an account in your directory
Stop all activity when unplugged	Keep any access after it is powered off

Any testing or scanning the device performs on your network is governed by your agreement with your security provider. The sections below cover only the network access the device needs in order to reach your security provider.

What to have ready

• The card from the box.
• A power outlet. The device ships with a 36W adapter and a plug for your region.
• A wired network port with normal internet access. A Cat6 cable is in the box.
• A location with airflow. The device is fan-cooled and should not be placed in a sealed cabinet.
• Usable cellular signal, if possible. The device has a cellular connection as a backup path, and basements and interior server rooms often have no signal.

Network requirements

All connections are outbound, from the device to the internet. No inbound rules are needed.

Destination

Allow the VPN address from the card. If your firewall matches on hostnames, allow the hostname. If it requires an IP address, ask your security provider for it. The address is dedicated to your engagement and does not change.

Ports

Protocol	Port	Purpose	Requirement
TCP	443	Management, signaling, and encrypted relay. Carries all traffic on its own if UDP is unavailable.	Required
UDP	3478	NAT traversal (STUN/TURN), so the device can establish a direct tunnel	Preferred
UDP	51820	WireGuard direct tunnel	Preferred
UDP	49152-65535	Direct tunnel establishment and TURN relay allocations	Preferred

With TCP 443 alone, the device comes online and stays online, but all traffic is relayed through the VPN host, which adds latency. With the UDP ports as well, the device establishes a direct tunnel, which is faster. No other ports are needed.

Other addresses the device contacts

The device checks its own internet connectivity and public IP address by making standard HTTPS requests to public services such as api.ipify.org, checkip.amazonaws.com, icanhazip.com, and www.google.com. These use TCP 443 and TCP 80, carry no information about your network beyond the request itself, and determine whether the device stays on the wired connection or falls back to cellular.

All other device traffic goes through the encrypted tunnel to your security provider.

DNS and time

The device needs DNS resolution and outbound time synchronization, like any other client on the network. It takes its DNS servers from DHCP. If your network blocks external DNS and does not provide an internal resolver over DHCP, the device cannot resolve the VPN address and will not connect.

Not required

• Inbound rules of any kind.
• UDP 80 or UDP 5555. These are used by other VPN products, not by ARROW.
• TCP port ranges. TCP 443 is the only TCP port the device uses.
• A static IP address. The device uses DHCP. If your policy requires a fixed address, use a DHCP reservation for the device’s MAC address.

Firewall change request

The following text can be pasted into a firewall change ticket:

Device:       ARROW security appliance, managed by the security provider
Direction:    Outbound only. No inbound rules.
Source:       DHCP address of the ARROW appliance
Destination:  The VPN address on the card (format: 00000.arrowvpn.io)

Required:
  TCP 443              Management, signaling, and encrypted relay

Preferred (enables a direct tunnel; performance only):
  UDP 3478             NAT traversal (STUN/TURN)
  UDP 51820            WireGuard tunnel
  UDP 49152-65535      Direct tunnel establishment and TURN relay

Notes:
  All traffic is encrypted (WireGuard and TLS).
  The appliance initiates every connection. Nothing connects to it from outside.
  Removing power stops all activity.

Setting up the device

1. Place the device where it will stay, with clear space around the vents.
2. Connect the Ethernet cable to a network port with internet access.
3. Connect power, using the supplied adapter or a USB-C PD supply.
4. Wait a few seconds. The device starts on its own and the fan spins up. If the fan does not start, press the power button once.
5. Leave the device for about five minutes.

No configuration is needed. The device was provisioned before shipping and connects on its own.

Power button and indicator lights

The board from above, with the lid removed

1. 1 Power button. A short press starts the device if it did not start on its own.
2. 2 Indicator lights, one red and one blue. Both are lit whenever the device has power, whether or not it has started.

On the assembled device, the power button is reachable through an opening in the side of the case at that corner. A power symbol on the lid marks the position.

The power button position, shown with the lid lifted

×

The power button position, shown with the lid lifted

Confirming the device is online

The device has no display. Your security provider sees it come online in their console a few minutes after it is powered on. Let them know when it is connected so they can confirm.

At the device, the indicator lights and the fan show its state:

Lights	Fan	State
Off	Off	No power. Check the adapter, cable, and outlet.
On	Running	Powered and running.
On	Off	Powered but not started. Press the power button once.

Lights on and fan running means the device is running. It does not confirm that the device reached the internet. That confirmation comes from your security provider.

Site conditions that block the device

Check these before the device arrives. Each one needs a different change, often from a different team.

802.1X or network access control. If ports authenticate devices before granting access, the device gets no address and no connectivity. Add a MAC Authentication Bypass entry for the device, or use a port that does not require 802.1X. Tell your security provider if this applies.

Guest or captive portal network. The device cannot complete a web-page sign-in. Use a standard wired port.

TLS inspection. If an egress proxy intercepts and re-signs HTTPS, the tunnel fails certificate validation. Add the VPN address to the inspection bypass list.

Explicit proxy. The device does not use proxy settings from the network. If all outbound traffic must go through an explicit proxy, tell your security provider before the device ships so the device can be configured for it.

DNS filtering. Category filters may classify the VPN domain as blocked. Allow the VPN address at the DNS layer as well as at the firewall.

Category-based outbound rules. A rule that blocks “VPN” or “anonymizer” traffic as a category blocks the device even when the host is allowed. Allow the host explicitly.

Troubleshooting

The lights are on but nothing else happens.

The device has power but has not started. The fan is silent and the device does not appear in your security provider’s console. Press the power button once. The fan starts within a second or two, and the device comes online about five minutes later.

If pressing the button does nothing, the device is not receiving enough power. Check the adapter, cable, and outlet. If using a USB-C supply, switch to the supplied adapter. The device needs a 20V USB-C PD supply, and not all chargers provide one.

The device never came online.

Check in order:

1. The lights are on and the fan is running. If not, see above.
2. The network port is live and hands out DHCP addresses. Connect a laptop to the same port and confirm it gets an address and can browse.
3. TCP 443 outbound to the VPN address is allowed. From the same laptop on the same port, run the following, replacing 00000.arrowvpn.io with the address on the card:

curl -sS -o /dev/null -w '%{http_code}\n' --max-time 10 https://00000.arrowvpn.io

Any HTTP status code, including 401 or 404, means the path is open. A timeout or connection refused means the firewall rule is not in place or does not apply to that source address.

The device came online, then dropped, and is now slow.

The device has fallen back to cellular or to relayed traffic. Both keep it working at reduced speed. Confirm that UDP 3478 and UDP 51820 are allowed outbound, and check that no DPI or IPS rule terminates the tunnel after it establishes. Tell your security provider; they can see which path the device is using.

The device works on one port or VLAN but not another.

Compare the two for 802.1X, egress policy, and DNS servers. The difference is in port policy, not the device.

The device has an address but cannot resolve names.

The DHCP scope is handing out an internal DNS server that does not resolve external names or is filtering this one. Confirm the resolver works for external names and allow the VPN address on it.

Anything else.

Contact your security provider. They can see the device’s status, connection path, and logs from their console.

Returning the device

When the engagement ends, power the device off and unplug it. Your security provider arranges the return; a prepaid return label is usually included in the box. Nothing on the device needs to be wiped or reset. The firewall rule can be removed once the device has left the site.