# Firewall requirements (/en/introduction/firewall)

> For AI agents: see the complete documentation index at [llms.txt](/llms.txt).

To allow you to use Agora products in environments with restricted network access, Agora provides the following solutions: the firewall whitelist and the Agora cloud proxy.

The following table lists the support of Agora products for the two solutions:

| Agora Products                             | Firewall Whitelist | Agora Cloud Proxy |
| ------------------------------------------ | :----------------: | :---------------: |
| Video SDK (Native, third-party frameworks) |          ✘         |         ✔         |
| Video SDK (Web)                            |          ✔         |         ✔         |
| Signaling SDK (Native)                     |          ✔         |         ✘         |
| Signaling SDK (Web)                        |          ✔         |         ✔         |
| On-Premise Recording SDK                   |          ✘         |         ✔         |
| Interactive Gaming SDK                     |          ✘         |         ✘         |

* When using the firewall whitelist, add the domains and ports to the firewall whitelist, and do not set restrictions on IP addresses.
* When using Agora cloud proxy, refer to [Connect to Agora through a restricted network](/en/realtime-media/video/build/manage-connection-and-quality/cloud-proxy)

### Video SDK (Web) [#video-sdk-web]

Add the following destination domains and the corresponding ports to your firewall whitelist.

#### Domains [#domains]

```text
.agora.io
.edge.agora.io
.sd-rtn.com
.edge.sd-rtn.com
.ap.sd-rtn.com
.statscollector.sd-rtn.com
.webrtc-cloud-proxy.sd-rtn.com
.rtnsvc.com
.edge.rtnsvc.com
.rtesvc.com
.edge.rtesvc.com
```

<CalloutContainer type="info">
  <CalloutDescription>
    To improve connectivity over public networks, we recommend adding the domains listed above to your firewall allowlist.
  </CalloutDescription>
</CalloutContainer>

#### Ports [#ports]

| Destination ports                                                                                        | Port type | Operation |
| -------------------------------------------------------------------------------------------------------- | --------- | --------- |
| 80; 443; 3433; 3478; 4700 - 5000; 5668; 5669; 6080; 6443; 8667; 9667; 30011 - 30013 (for RTMP converter) | TCP       | Allow     |
| 3478; 4700 - 5000 (2.9.0 or later); 10000 - 65535 (before 2.9.0)                                         | UDP       | Allow     |

### Signaling SDK (Web) [#signaling-sdk-web]

#### Message channel [#message-channel]

For a message channel, you need to add the following content to the firewall whitelist:

* **Domains**:
  ```text
  .edge.agora.io
  .edge.sd-rtn.com
  web-1.ap.sd-rtn.com
  web-2.ap.sd-rtn.com
  web-3.ap.sd-rtn.com
  web-4.ap.sd-rtn.com
  ap-web-1.agora.io
  ap-web-2.agora.io
  ap-web-3.agora.io
  ap-web-4.agora.io
  webcollector-rtm.agora.io
  logservice-rtm.agora.io
  rtm.statscollector.sd-rtn.com
  rtm.logservice.sd-rtn.com
  ```

* **Ports**:
  | **Destination port**   | **Protocol** | **Operate** |
  | ---------------------- | ------------ | ----------- |
  | 443; 9591; 9593; 27387 | TCP          | Allow       |

<CalloutContainer type="info">
  <CalloutTitle>
    Info
  </CalloutTitle>

  <CalloutDescription>
    If you are using Signaling 1.x, also add port 9601.
  </CalloutDescription>
</CalloutContainer>

#### Stream channel [#stream-channel]

For a stream channel, you need to add the following to your firewall whitelist:

* **Domains**:

  ```text
  .agora.io
  .edge.agora.io
  .sd-rtn.com
  .edge.sd-rtn.com
  ```

* **Ports**:

  | **Destination port**                                      | **Protocol** | **Operate** |
  | --------------------------------------------------------- | ------------ | ----------- |
  | 80; 3433; 4700 - 5000; 5668; 5669; 6080; 6443; 8667; 9667 | TCP          | Allow       |
  | 3478; 4700 - 5000                                         | UDP          | Allow       |

### Signaling SDK (Native) [#signaling-sdk-native]

#### Message channel [#message-channel-1]

For a message channel, you need to add the following content to the firewall whitelist:

* **Domains**:
  ```text
  .agora.io
  ```
* **Ports**:
  | **Destination port**                                  | **Protocol** | **Operate** |
  | ----------------------------------------------------- | ------------ | ----------- |
  | 443; 7384; 8443; 9130; 9131; 9136; 9137; 9140; 9141   | TCP          | Allow       |
  | 1080; 3000; 8000; 8130; 8443; 9120; 9121; 9700; 25000 | UDP          | Allow       |

#### Stream channel [#stream-channel-1]

For a stream channel, you need to add the following to your firewall whitelist:

* **Ports**:

  | **Destination port** | **Protocol** | **Operate** |
  | -------------------- | ------------ | ----------- |
  | 4001 - 4150          | UDP          | Allow       |

<CalloutContainer type="info">
  <CalloutTitle>
    Info
  </CalloutTitle>

  <CalloutDescription>
    The target ports listed in this section may be adjusted according to actual conditions. If you encounter any issues, contact [rtm@agora.io](mailto\:rtm@agora.io).
  </CalloutDescription>
</CalloutContainer>