Firewall and Network Configuration

If you need to get Twilio Video working quickly, allow the following outbound traffic from your network. All connections are initiated outbound by the client — return traffic is handled automatically by stateful firewall connection tracking. No inbound firewall rules are required.

Twilio Video attempts to establish media connections in the following order. Each fallback adds latency that can affect call quality.

If your network only allows TCP port 443, Twilio Video still functions, but users may experience degraded audio and video quality due to the overhead of TCP/TLS delivery acknowledgments and packet retransmission.

Twilio Video uses persistent WebSocket Secure (WSS) connections on port 443 for signaling. Your firewall must allow outbound WSS connections to the following hostnames. These hostnames are also the values to use for FQDN-based firewall rules, SNI-based proxy bypass configurations, and SSL inspection exclusion lists.

Wildcard pattern: *.vss.twilio.com

Additional required domains:

• sdkgw.us1.twilio.com (WSS/443)
• ecs.us1.twilio.com (HTTPS/443) — only required for pre-2021 SDKs: Android < 5.9.0, iOS < 3.5.0, JavaScript SDK < 2.5.0

STUN/TURN domains:

• *.stun.twilio.com (UDP/3478)
• *.turn.twilio.com (UDP/3478 and TLS/443)

• All SDK Versions

Ports used: 10,000 - 60,000 UDP/SRTP/SRTCP and TLS/443 and UDP/3478.

Corporate firewalls and proxies can interfere with Twilio Video traffic in ways that go beyond simple port blocking. If your network uses any of the following, additional configuration is required.

TLS-inspecting proxies (also called SSL decryption or man-in-the-middle proxies) intercept and re-encrypt TLS traffic. This will break TURN-TLS connections on port 443 and can prevent Twilio Video from establishing media connections entirely.

Required action: Add all Twilio Video domains to your proxy's SSL inspection exclusion list, including *.vss.twilio.com, sdkgw.us1.twilio.com, *.turn.twilio.com, and *.stun.twilio.com. If your proxy supports SNI-based bypass rules, configure exclusions for these same patterns.

DPI and protocol analyzers add processing latency that is unacceptable for real-time media. Even when they don't block traffic, they can introduce jitter and packet delays that degrade audio and video quality.

Required action: Exclude the Twilio Video IP address ranges and port ranges from DPI inspection policies.

SIP ALG can be turned on by default on corporate firewalls. It rewrites VoIP-related packet payloads in an attempt to assist NAT traversal. However, SIP ALG can silently corrupt STUN and TURN packets, causing connection failures or one-way audio/video.

Required action: Turn off SIP ALG on firewalls and routers in the media path for Twilio Video traffic.

Application-aware firewalls classify traffic by protocol, not just port number. STUN, TURN, and DTLS traffic may be categorized as "unknown" or "suspicious" and silently dropped, even when the destination port is allowed.

Required action: Create explicit application-level allow rules for STUN, TURN, and DTLS protocols on the ports listed in the connection priority table.

Twilio Video uses persistent WebSocket connections for signaling throughout the duration of a video call. Proxies and firewalls with aggressive idle timeout settings (common defaults: 60 - 120 seconds) can terminate these connections mid-call, causing participants to disconnect.

Recommended action: Set the WebSocket (WSS) idle timeout on your proxy or firewall to at least 300 seconds (5 minutes) for connections to Twilio Video signaling domains. Video calls can have extended periods of low signaling activity, and shorter timeouts risk dropping the connection.

If your network requires all traffic to pass through a forward proxy:

• The proxy must support WebSocket (WSS) pass-through without inspection for signaling traffic
• UDP traffic to Twilio media server IP ranges should bypass the proxy entirely, as most HTTP proxies cannot handle UDP. SOCKS5 proxies can proxy UDP traffic if direct bypass is not possible
• If the proxy doesn't support UDP pass-through, Twilio Video falls back to TURN-TLS on TCP port 443, which adds latency

If your users connect via VPN, routing real-time video traffic through the VPN tunnel adds latency and can significantly degrade call quality. Configure split tunneling to route Twilio Video traffic directly from the user's local network rather than through the VPN tunnel.

Traffic to route directly (bypass VPN):

• UDP ports 10,000 - 60,000, 3478 to the media server IP ranges
• TCP/WSS port 443 to Twilio Video signaling domains

Bandwidth requirements vary based on video resolution, number of participants, and whether screen sharing is active. Downstream bandwidth scales with the number of remote participants sending video.

To review detailed per-resolution bitrate recommendations, see Minimum bandwidth recommendations.

If participants are experiencing connectivity issues with Twilio Video, use the following to diagnose the cause.

To verify network connectivity, run the Twilio Video Diagnostics App from the affected network. It tests signaling, media, and TURN connectivity and reports which paths are available. To access developer-level diagnostic tools, see Pre-call Testing and Diagnostics.