Firewall settings for CloudXR Server workstations

Local-firewall ports and executables to allow on a CloudXR workstation so Innoactive Spatial Runtime can stream to Apple Vision Pro and other headsets on the same subnet.

These instructions apply to the firewall of a dedicated workstation acting as a CloudXR server. They define the ports and protocols that must be open locally to enable communication with Innoactive Portal client application on the headset.

If you are instead configuring the corporate network firewall (for cloud or on-premises environments), refer to this article.

If you need help to optimize local streaming you can find further information (configuring antivirus and router channels) in Optimize the network for local streaming.

Innoactive Spatial Runtime (CloudXR 6)

The default installation directory is C:\ProgramData\Innoactive\Spatial Runtime\. Adjust paths below if your organization uses a custom install location.

ComponentExecutableDescriptionDirectionProtocolPort(s)
Innoactive Spatial RuntimeInnoactive Spatial Runtime.exeREST API (HTTP)InboundTCP42084
Innoactive Spatial RuntimeInnoactive Spatial Runtime.exeREST API (HTTPS)InboundTCP42085
Innoactive Spatial RuntimeInnoactive Spatial Runtime.exeWebSocket Secure (WSS) signaling for CloudXRInboundTCP48322
Innoactive Spatial RuntimeInnoactive Spatial Runtime.exeApple Vision Pro Foveated Streaming session managementInboundTCP55000
Innoactive Spatial RuntimeInnoactive Spatial Runtime.exemDNS / Bonjour service discovery (multicast 224.0.0.251)Inbound + OutboundUDP5353
CloudXRCloudXR Runtime Host.exe, CloudXrService.exeMedia streaming (video, audio, control)InboundUDP47995, 47998-48002, 48005, 48008, 48012
CloudXRCloudXR Runtime Host.exe, CloudXrService.exeMedia streaming responsesOutboundUDP49003-49006, 50000-55000
CloudXRCloudXR Runtime Host.exe, CloudXrService.exeSignaling and session controlInboundTCP48010, 48322
CloudXRCloudXR Runtime Host.exe, CloudXrService.exeControl channelOutboundTCP49007

Notes:

  • All traffic is local network only. Streaming happens on the same local subnet — no internet-bound traffic is required.
  • mDNS / multicast: Some enterprise firewalls block multicast traffic by default. Ensure UDP multicast to 224.0.0.251:5353 is permitted on the local subnet. Without this, headsets cannot automatically discover the PC.
  • Configurable ports: The REST API ports (42084, 42085) and Apple Vision Pro session management port (55000) can be changed in appsettings.json. If changed, firewall rules must be updated to match.
  • Application-aware firewalls: If your firewall filters by application identity, ensure the following executables are allowed: Innoactive Spatial Runtime.exe, CloudXR Runtime Host.exe, and CloudXrService.exe (all located in the installation directory).
  • Additional component (no network exposure): Installation also includes the Innoactive OpenXR Runtime Service — a Windows service (InnoactiveOpenXRRuntimeService) installed under C:\Program Files\Innoactive\OpenXR Runtime Service\, running as LocalSystem. It communicates with the tray app via a local named pipe only and requires no firewall configuration.

Previous Versions

DescriptionDirection*ProtocolPort
CloudXR ControlInboundUDP47999
CloudXR AudioInboundUDP48000
CloudXR VideoInboundUDP47998, 48005, 48008, 48012, 47995, 48001
CloudXR MicrophoneInboundUDP48002
CloudXR RTSPInboundTCP48010
CloudXR ControlOutboundUDP49006
CloudXR AudioOutboundUDP49003
CloudXR VideoOutboundUDP49005, 50000–55000
CloudXR MicrophoneOutboundUDP49004
CloudXR RTSPOutboundTCP49007

* All directions are from the dedicated workstation/server perspective.

Whitelist all IPs that could be used by your HMD, so either allow all IP addresses on those ports or limit to the IP range that the HMDs will use.