General Firewall Rules
Last updated on
If you are behind a firewall that is restricting access to Louper, please ask your network administrator to allow access to the following domains and ports on your network:
Domains
| Domain | Notes |
|---|---|
| *.louper.io | Louper operates critical infrastructure across multiple subdomains of louper.io. To ensure full functionality and uninterrupted service, please allow all subdomains of louper.io on your firewall using a wildcard entry *.louper.io |
| louper.livekit.cloud | Live rooms: signalling |
| louper.turn.livekit.cloud | Live rooms: media relay (TURN) |
| louper-socket.webpubsub.azure.com | Real-time updates (websockets) |
| 7c0156406db632b32eddd4fdd52b0686 | File storage (uploads and downloads) |
| image.mux.com, stream.mux.com | Video thumbnails and playback |
| *.edgemv.mux.com | Recorded-video playback (Mux CDN edges) |
| identitytoolkit.googleapis.com, securetoken.googleapis.com | Sign-in and authentication |
| fonts.googleapis.com, fonts.gstatic.com | App fonts |
If your users sign in with Google, Google's sign-in pages also need to be reachable. These are listed in Advanced Firewall Rules, along with every individual Louper hostname for firewalls that don't support wildcards.
Ports
All rules are outbound, from the user's device.
For traffic to all domains listed above
- TCP 443
For live rooms, to Louper streaming servers (*.louper.io)
- UDP 443
- UDP 10006-10010
- UDP 50000-60000
For live rooms, to louper.turn.livekit.cloud
- UDP 443
For RTMP / SRT streaming from encoders to *.louper.io
Only needed if you send streams into Louper from hardware or software encoders.
- TCP 1935 (RTMP)
- UDP 9999 (SRT)
Inbound Traffic
No inbound firewall rules are required on a stateful firewall. Live-room streams are delivered over WebRTC, so their video and audio arrive as inbound UDP from Louper streaming servers and LiveKit. This traffic is a reply on a connection the browser opened, so a stateful firewall allows it automatically.
If your firewall is stateless, or blocks inbound UDP regardless of connection state, allow inbound UDP from Louper streaming servers and LiveKit to your users' devices. Otherwise, live-room streams fall back to a relayed connection with higher latency, or may fail to play. The exact sources and ports are listed in Advanced Firewall Rules.
UDP Hole-Punching
Please ensure UDP hole-punching is enabled, or disable symmetric NAT. This helps machines behind the firewall establish a direct connection to Louper servers.