Advanced Firewall Rules
Last updated on
This page lists every TCP/UDP port and domain (FQDN) required by Louper, including whether rules are needed for inbound or outbound traffic. It's intended for IT and security teams that need to allow individual hostnames rather than wildcards, or need official network configuration documentation. For most networks, General Firewall Rules is enough.
Summary
No inbound firewall rules are required on a stateful firewall. Every connection is opened from the user's browser or Louper desktop app to the destinations on this page. Live-room streams (WebRTC) do arrive as inbound UDP from Louper streaming servers and LiveKit, but as replies on connections the browser opened, so a stateful firewall allows them automatically. If your firewall is stateless, or blocks inbound UDP regardless of connection state, see Inbound traffic.
This list was verified end-to-end on an isolated network where only these destinations were allowed. The test covered reviewing, uploading, video playback and live rooms. It reflects the hosts that the Louper web app (app.louper.io) actually contacts.
Simplest option: if your policy allows wildcards, *.louper.io covers every Louper-operated hostname in Static hostnames and Streaming server inventory, including servers added in the future. The third-party hosts still need to be allowed separately.
Static hostnames
Louper application
| FQDN | Purpose |
|---|---|
app.louper.io | Web application |
backend.louper.io | API |
auth-prod.louper.io | Sign-in |
bunny.louper.io | Static assets / CDN |
backblaze-assets.louper.io | Media assets / CDN |
download.louper.io | Desktop app downloads |
ingest.louper.io | Upload / ingest coordination |
openpanel.louper.io | Product analytics (optional; the app works without it) |
Regional streaming entry points
| FQDNs | Region |
|---|---|
stream-edge.louper.io, stream-ingest.louper.io | Global entry points (resolve to the nearest region) |
stream-sfr-edge.louper.io, stream-sfr-ingest.louper.io | US West: San Francisco |
stream-lax-edge.louper.io, stream-lax-ingest.louper.io | US West: Los Angeles |
stream-nyc-edge.louper.io, stream-nyc-ingest.louper.io | US East: New York |
stream-lon-edge.louper.io, stream-lon-ingest.louper.io | UK: London |
stream-bra-edge.louper.io, stream-bra-ingest.louper.io | Brazil: São Paulo |
stream-jnb-edge.louper.io, stream-jnb-ingest.louper.io | Africa: Johannesburg |
stream-sgp-edge.louper.io, stream-sgp-ingest.louper.io | Asia: Singapore |
stream-syd-edge.louper.io, stream-syd-ingest.louper.io | Australia: Sydney |
Third-party services
| FQDN | Purpose |
|---|---|
louper.livekit.cloud | Live rooms: signalling |
louper.turn.livekit.cloud | Live rooms: media relay (TURN) |
louper-socket.webpubsub.azure.com | Real-time updates (websockets) |
7c0156406db632b32eddd4fdd52b0686 | File storage (uploads and downloads) |
image.mux.com, stream.mux.com | Video thumbnails and playback playlists |
fonts.googleapis.com, fonts.gstatic.com | App fonts |
Sign-in
Users can sign in to Louper with an email and password, or with a Google, Microsoft or Apple account. You only need to allow the hosts for the sign-in method your users use.
| FQDN | Purpose |
|---|---|
identitytoolkit.googleapis.com, securetoken.googleapis.com | Token exchange with Louper's authentication backend (Firebase Auth) |
Google sign-in. If your users sign in with Google, also allow Google's own sign-in pages below. A browser contacts them on a fresh sign-in, such as a new browser profile, an incognito window or after signing out. These hosts were verified end-to-end, including 2-step verification.
| FQDN | Purpose |
|---|---|
accounts.google.com | Google sign-in page |
accounts.google.<country-TLD> | Google redirects users to an accounts domain for their country, e.g. accounts.google.co.uk, accounts.google.de. For US users this is accounts.google.com itself. |
apis.google.com, www.google.com, play.google.com | Sign-in page scripts and account chooser |
ssl.gstatic.com, www.gstatic.com | Sign-in page assets |
lh3.googleusercontent.com | App and profile logos on the sign-in and consent screens |
signaler-pa.clients6.google.com | Real-time channel that completes 2-step verification (phone prompt) |
accounts.youtube.com | Session sync after sign-in (Google always performs this) |
Microsoft or Apple sign-in. The provider's sign-in pages are normally already reachable on your network, since they're the same pages used to sign in to that provider anywhere else. If they aren't, contact Louper support and we will confirm the hosts for that provider.
Streaming server inventory
Current as of September 14, 2026.
During a live room, the app connects directly to an individual streaming server. These servers are named stream-<region>-edge-<id>.louper.io and stream-<region>-ingest-<id>.louper.io. Each edge server also has a matching turn-<region>-edge-<id>.louper.io name for its TURN relay.
The tables below are the complete current inventory. The list only changes when Louper adds or replaces a server. When that happens, this page is updated with a new date. Contact Louper support if you want to be notified before changes go live.
If you'd rather not track individual servers, there are two alternatives. You can allow *.louper.io. Or, if you use IP-based FQDN objects, add the regional entry points: they resolve to the same IP addresses and cover most of these servers.
Edge servers (playback in rooms)
| Region | stream- hostnames | turn- hostnames |
|---|---|---|
| San Francisco | stream-sfr-edge-dlpyf.louper.iostream-sfr-edge-dwrvm.louper.iostream-sfr-edge-wlhqt.louper.io | turn-sfr-edge-dlpyf.louper.ioturn-sfr-edge-dwrvm.louper.ioturn-sfr-edge-wlhqt.louper.io |
| Los Angeles | stream-lax-edge-asdle.louper.iostream-lax-edge-rxnyt.louper.iostream-lax-edge-usyxi.louper.io | turn-lax-edge-asdle.louper.ioturn-lax-edge-rxnyt.louper.ioturn-lax-edge-usyxi.louper.io |
| New York | stream-nyc-edge-cpoqe.louper.iostream-nyc-edge-drdfa.louper.iostream-nyc-edge-wqvtb.louper.iostream-nyc-edge-xghkk.louper.io | turn-nyc-edge-cpoqe.louper.ioturn-nyc-edge-drdfa.louper.ioturn-nyc-edge-wqvtb.louper.ioturn-nyc-edge-xghkk.louper.io |
| London | stream-lon-edge-dcbdj.louper.iostream-lon-edge-rmgwh.louper.io | turn-lon-edge-dcbdj.louper.ioturn-lon-edge-rmgwh.louper.io |
| São Paulo | stream-bra-edge-kbisb.louper.iostream-bra-edge-vkgbf.louper.io | turn-bra-edge-kbisb.louper.ioturn-bra-edge-vkgbf.louper.io |
| Johannesburg | stream-jnb-edge-mdasn.louper.iostream-jnb-edge-sbxnl.louper.io | turn-jnb-edge-mdasn.louper.ioturn-jnb-edge-sbxnl.louper.io |
| Singapore | stream-sgp-edge-cwlhg.louper.iostream-sgp-edge-ftbqt.louper.io | turn-sgp-edge-cwlhg.louper.ioturn-sgp-edge-ftbqt.louper.io |
| Sydney | stream-syd-edge-gtfta.louper.iostream-syd-edge-rqkdx.louper.io | turn-syd-edge-gtfta.louper.ioturn-syd-edge-rqkdx.louper.io |
Ingest servers (contribution: RTMP/SRT from encoders, and publishing from the browser)
| Region | FQDNs |
|---|---|
| San Francisco | stream-sfr-ingest-amwpt.louper.iostream-sfr-ingest-lnhtt.louper.iostream-sfr-ingest-wasdp.louper.io |
| Los Angeles | stream-lax-ingest-dpcos.louper.iostream-lax-ingest-sdfsn.louper.iostream-lax-ingest-vggkn.louper.io |
| New York | stream-nyc-ingest-asodw.louper.iostream-nyc-ingest-bpowe.louper.iostream-nyc-ingest-ccvkb.louper.iostream-nyc-ingest-fhfsq.louper.iostream-nyc-ingest-xdkhx.louper.io |
| London | stream-lon-ingest-lkshm.louper.iostream-lon-ingest-rwhdy.louper.io |
| São Paulo | stream-bra-ingest-exxyz.louper.iostream-bra-ingest-njugz.louper.io |
| Johannesburg | stream-jnb-ingest-mxlmp.louper.iostream-jnb-ingest-oidjf.louper.io |
| Singapore | stream-sgp-ingest-awfhc.louper.iostream-sgp-ingest-xpdbg.louper.io |
| Sydney | stream-syd-ingest-cwdrw.louper.iostream-syd-ingest-fyxbu.louper.iostream-syd-ingest-pymuu.louper.io |
This inventory is also available as a plain text or CSV file, or with the IP address for each name. Contact Louper support to request it.
Third-party wildcards
Required
| Pattern | Provider | Notes |
|---|---|---|
*.edgemv.mux.com | Mux | Mux's regional CDN edges, which serve manifests and segments for recorded video (e.g. manifest-oci-us-ashburn-1-vop1.edgemv.mux.com, chunk-oci-us-phoenix-1-vop1.edgemv.mux.com). The edge used depends on the viewer's location and Mux's routing, so these hosts can't be listed individually. Without this wildcard, recorded-video playback fails; everything else in the app still works. All of these hostnames resolve through endpoint.edgemv.orastreaming.net. If your firewall allows by resolved IP rather than by SNI, that single FQDN covers all of them. |
Optional: recommended for the best live-room quality
| Pattern | Provider | Notes |
|---|---|---|
*.host.livekit.cloudUDP 3478, UDP 50000–60000 | LiveKit | Direct UDP media path for live rooms. Rooms work with two-way audio and video without this, using only louper.livekit.cloud and louper.turn.livekit.cloud. However, all media is then relayed through TURN over port 443, which adds some latency. Allowing this wildcard gives participants the direct path. |
Ports
Outbound rules
From the user's device to the destinations listed:
| Ports | Destinations |
|---|---|
| TCP 443 | All hosts on this page |
| UDP 443, UDP 10006–10010, UDP 50000–60000 | Louper edge and ingest servers (live rooms) |
| UDP 443 | louper.turn.livekit.cloud (TURN relay) |
| UDP 3478, UDP 50000–60000 | *.host.livekit.cloud: only if you enable the optional direct path |
| TCP 1935 (RTMP), UDP 9999 (SRT) | stream-*-ingest-*.louper.io only, and only if you send streams into Louper from hardware or software encoders |
Inbound traffic: live-room streams (WebRTC)
The streams viewers watch in a live room are delivered over WebRTC. The browser opens each session by sending UDP from a local port to the server. The server then sends the stream's video and audio back to that same address and port, so this media is inbound traffic to the user's device.
| Inbound from | Source ports | Carries |
|---|---|---|
| Louper edge and ingest servers (inventory) | The UDP ports listed for them above, e.g. UDP 10006–10010 | Live-room stream video and audio, and connection checks |
louper.turn.livekit.cloud | UDP 443 | Live-room media relayed through TURN |
*.host.livekit.cloud (if enabled) | UDP 3478, UDP 50000–60000 | Live-room media on the optional direct path |
In every case the destination is the user's device, on the local UDP port it used to open the session. Louper servers never start a connection to the user's device unprompted.
- Stateful firewalls (most enterprise firewalls) treat this media as return traffic on an established session and allow it automatically. No inbound rule is needed.
- Stateless firewalls, or policies that block inbound UDP regardless of state, must allow inbound UDP from the sources above to clients' ephemeral UDP ports. Otherwise, live-room streams fall back to a relayed connection with higher latency, or may fail to play.
- NAT: make sure UDP hole-punching is enabled, or avoid symmetric NAT for these destinations. This lets the device keep a direct UDP path to Louper's servers.
CDN targets behind Louper hostnames
You don't need these if your resolver-based rules follow CNAMEs. They are listed for completeness.
| Louper hostname | Resolves via |
|---|---|
app.louper.io | dlak4tiwj0fbx.cloudfront.net |
download.louper.io | d3p0g5g2d3jcwi.cloudfront.net |
bunny.louper.io | louper-production.b-cdn.net |
backblaze-assets.louper.io | backblaze-assets-prod.b-cdn.net |
louper-socket.webpubsub.azure.com | louper-socket-southeastasia (via Azure Traffic Manager) |
backend.louper.io | backend.louper-media.io (Cloudflare-fronted) |