Firewall configuration and IP / Port whitelisting for Cloud streaming

Corporate firewall rules — UDP and TCP ports, protocols, and directions — required for Wireguard, DCV, WebRTC, and CloudXR traffic on the Portal cloud platform.

⚠️ This page applies only to cloud streaming (and on-premises streaming over a corporate network).

It describes the corporate / network-level firewall rules required for the Innoactive cloud streaming platform (Wireguard tunnel, DCV, WebRTC, Interactive Spectator, Health Agent, etc.).

If you are running Innoactive Spatial Runtime on a local workstation and streaming to a headset on the same local network (e.g. an Apple Vision Pro connected over Wi-Fi), the rules on this page do not apply. See Firewall settings for CloudXR Server workstations instead.

Encrypted VR Streaming

​DescriptionDirection*ProtocolPortIP addresses
Encrypted Wireguard TunnelOutboundUDP51820Dynamic IPs from pre-defined ranges per default​ ​ Fixed IPs on request
Encrypted Wireguard TunnelInboundUDP51820
Interactive SpectatorOutboundUDP48020-48119
Innoactive Health Agent​**OutboundTCP53089
​WebRTC STUN/TURNOutboundUDP, TCP​3478, 80162.55.53.5​157.90.22.86
DCVOutboundTCP443

Unencrypted VR Streaming

​DescriptionDirection*ProtocolPortIP addresses
CloudXR ControlOutboundUDP47999Dynamic IPs from pre-defined ranges per default​ ​ Fixed IPs on request
CloudXR AudioOutboundUDP48000
CloudXR VideoOutboundUDP47998, 48005, 48008, 48012, 47995, 48001
​CloudXR MicrophoneOutboundUDP48002
CloudXR RTSPOutboundTCP48010
CloudXR Signaling (WSS) — CloudXR 6+OutboundTCP48322
CloudXR Apple Vision Pro foveated streaming — CloudXR 6+OutboundTCP55000
CloudXR ControlInboundUDP49006
CloudXR AudioInboundUDP49003
CloudXR VideoInboundUDP49005, 50000-55000
​CloudXR MicrophoneInboundUDP49004
CloudXR RTSPInboundTCP49007
Interactive SpectatorOutboundUDP48020-48119
Innoactive Health Agent​**OutboundTCP53089
​WebRTC STUN/TURNOutboundUDP, TCP​3478, 80162.55.53.5​157.90.22.86
DCVOutboundTCP443

*From client perspective

**Required for on-premises deployment only

***CloudXR 6+ adds two signaling ports — TCP 48322 for WebSocket Secure (WSS) session signaling, and TCP 55000 for Apple Vision Pro Foveated Streaming session management. Earlier CloudXR releases do not require these. Despite living in the Unencrypted VR Streaming table, the WSS signaling channel itself is TLS-encrypted — the section label refers only to the absence of the Wireguard tunnel wrapper.

‌