Connect through restricted networks with Cloud Proxy
Large enterprises, hospitals, universities, banks, and other institutions commonly deploy firewalls to meet their stringent security requirements. To ensure uninterrupted access to its services for enterprise users behind firewalls, Agora offers firewall whitelist and Cloud Proxy services.
Admins enable users to use Video SDK in network-restricted environments by adding specific IP addresses and ports to the firewall whitelist. Users make API calls to configure the Cloud Proxy service.
Understand the tech
Cloud Proxy works as follows:
- Video SDK initiates a request to Cloud Proxy.
- Cloud Proxy returns the corresponding proxy information.
- Agora SDK sends data to Cloud Proxy. Cloud Proxy receives the data and transmits it to Agora SD-RTN™.
- Agora SD-RTN™ returns data to Cloud Proxy. Cloud Proxy receives the data and sends it to the SDK.
Prerequisites
Ensure that you have implemented the SDK quickstart in your project.
Implement Cloud Proxy
Since Web SDK v4.3.0, Agora has optimized the Cloud Proxy architecture, enhanced the connectivity of the SDK in environments with restricted network access, and supports restricted access areas. Agora recommends that you upgrade to v4.3.0 or above.
Depending on the Web SDK version you are using, refer to the corresponding implementation method:
- v4.3.0 or above
- v4.0.0-v4.2.1
-
Contact Agora support and provide the following information to request Cloud Proxy service:
- App ID
- Cloud Proxy service usage area
- Concurrency scale
- Network operator and other relevant information
-
After successful activation, call the
startProxyServer
method and set themode
parameter before joining the channel:-
Force UDP cloud proxy mode: Set
mode
to3
. Cloud proxy using UDP protocol. In this mode, the SDK always transmits data using UDP protocol. -
Force TCP cloud proxy mode: Set
mode
to5
. (Supported since v4.9.0) Cloud proxy using TCP (encryption) protocol. In this mode, the SDK always transmits data over TLS 443.
-
-
Test if you can initiate audio and video calls or live broadcasts normally.
-
Video SDK provides a
client.on("is-using-cloud-proxy")
event that triggers the callback after the media stream is successfully published locally, to inform whether the current media stream is forwarded by the cloud proxy service. -
To stop using the proxy server, call
stopProxyServer
after leaving the channel.
-
Contact Agora support and provide the following information to request Cloud Proxy service:
- App ID
- Cloud Proxy service usage area
- Concurrency scale
- Network operator and other relevant information
-
Configure the firewall whitelist
Add the following test IP addresses and ports to your corporate firewall whitelist. The source address is the client integrated with the Web SDK.
Domestic testing
Protocol Target Address Port Port Usage TCP 150.138.153.78 443, 4000, 3433 - 3460 Message data transmission, media data exchange TCP 47.74.211.17 443 Edge node communication TCP 52.80.192.229 443 Edge node communication TCP 52.52.84.170 443 Edge node communication TCP 47.96.234.219 443 Edge node communication UDP 150.138.153.78 3478-3500 media data exchange Overseas testing
Protocol Target Address Port Port Usage TCP 23.236.115.138 443, 4000, 3433 - 3460 Message data transmission, media data exchange TCP 148.153.66.218 443, 4000, 3433 - 3460 Message data transmission, media data exchange TCP 47.74.211.17 443 Edge node communication TCP 52.80.192.229 443 Edge node communication TCP 52.52.84.170 443 Edge node communication TCP 47.96.234.219 443 Edge node communication UDP 23.236.115.138 3478-3500 media data exchange UDP 148.153.66.218 3478-3500 media data exchange InformationThe above IPs are only meant for debugging during the test phase. Before official launch, apply for custom cloud proxy service resources from Agora. -
To turn on cloud proxy server before joining the channel, call:
client.startProxyServer();
-
To turn off cloud proxy server after leaving the channel, call:
client.stopProxyServer();
Reference
This section contains content that completes the information on this page, or points you to documentation that explains other aspects to this product.
Firewall whitelist
-
v4.4.0 or above
-
v4.0.0 - v4.4.0
Target Port | Protocol | Operate |
---|---|---|
80; 443; 3433; 4700 - 5000; 5668; 5669; 6080; 6443; 8667; 9667; 30011 - 30013 (for bypass push flow) | TCP | allow |
3478; 4700 - 5000 (version 2.9.0 and later); 10000 - 65535 (version before 2.9.0) | UDP | allow |