Ports to whitelist on the workstation firewall

Inbound and outbound TCP/UDP ports that must be allowed on the RTX workstation firewall so Innoactive Spatial can stream to Apple Vision Pro.

These rules apply to the local firewall of the RTX workstation that streams to Apple Vision Pro. They define the inbound and outbound ports needed for Innoactive Spatial to discover the workstation and stream a session.

All traffic is local-subnet only — no internet egress is required for the session itself. For deeper context on what each process does, see Runtime processes and networking overview.

Default installation paths

  • Innoactive Spatial Runtime + CloudXR binaries: C:\ProgramData\Innoactive\Spatial Runtime\
  • Innoactive OpenXR Runtime Service: C:\Program Files\Innoactive\OpenXR Runtime Service\

Adjust the paths in your firewall rules if your organization installs to a custom location.

Ports for Innoactive Spatial Runtime 2.0.x and newer (CloudXR 6)

ComponentExecutableDescriptionDirectionProtocolPort(s)
Innoactive Spatial RuntimeInnoactive Spatial Runtime.exeREST API (HTTP)InboundTCP42084
Innoactive Spatial RuntimeInnoactive Spatial Runtime.exeREST API (HTTPS)InboundTCP42085
Innoactive Spatial RuntimeInnoactive Spatial Runtime.exeWebSocket Secure (WSS) signaling for CloudXRInboundTCP48322
Innoactive Spatial RuntimeInnoactive Spatial Runtime.exeApple Vision Pro Foveated Streaming session managementInboundTCP55000
Innoactive Spatial RuntimeInnoactive Spatial Runtime.exemDNS / Bonjour service discovery (multicast 224.0.0.251)Inbound + OutboundUDP5353
CloudXRCloudXR Runtime Host.exe, CloudXrService.exeMedia streaming (video, audio, control)InboundUDP47995, 47998–48002, 48005, 48008, 48012
CloudXRCloudXR Runtime Host.exe, CloudXrService.exeMedia streaming responsesOutboundUDP49003–49006, 50000–55000
CloudXRCloudXR Runtime Host.exe, CloudXrService.exeSignaling and session controlInboundTCP48010, 48322
CloudXRCloudXR Runtime Host.exe, CloudXrService.exeControl channelOutboundTCP49007

Only one of CloudXR Runtime Host.exe or CloudXrService.exe owns the CloudXR ports at any given time. Add rules for both — the active executable depends on the streaming strategy (static vs. dynamic foveation).

Notes

  • All traffic is local network only. Streaming happens on the same local subnet — no internet-bound traffic is required for a session.
  • mDNS / multicast is mandatory for discovery. Many enterprise switches block multicast traffic by default. Ensure UDP multicast to 224.0.0.251:5353 is permitted on the local subnet, otherwise the Vision Pro app will not see the workstation.
  • Configurable ports. The REST API ports (42084, 42085) and Apple Vision Pro session management port (55000) can be changed in appsettings.json. If you change them, update the firewall rules to match.
  • Application-aware firewalls. If your firewall filters by application identity, allow these executables: Innoactive Spatial Runtime.exe, CloudXR Runtime Host.exe, and CloudXrService.exe (all under the installation directory).
  • OpenXR Runtime Service has no network exposure. The bundled Windows service InnoactiveOpenXRRuntimeService under C:\Program Files\Innoactive\OpenXR Runtime Service\ communicates with the tray app via a local named pipe only. No firewall rule is needed for it.

VRED's own ports (third-party)

These ports are opened by Autodesk VRED itself, not by the Spatial Runtime. Allow them if you rely on the corresponding VRED features.

ComponentProtocolDefault PortNotes
VRED Web InterfaceTCP8888Browser-based VRED UI; also serves the Python remote API the Vision Pro app uses for variant sets and quality controls.
VRED CollaborationTCP8889Multi-user collaboration; port is configurable in VRED.

Previous CloudXR versions (for reference)

If you are on a legacy installation that pre-dates CloudXR 6, use the table below.

DescriptionDirection*ProtocolPort
CloudXR ControlInboundUDP47999
CloudXR AudioInboundUDP48000
CloudXR VideoInboundUDP47998, 48005, 48008, 48012, 47995, 48001
CloudXR MicrophoneInboundUDP48002
CloudXR RTSPInboundTCP48010
CloudXR ControlOutboundUDP49006
CloudXR AudioOutboundUDP49003
CloudXR VideoOutboundUDP49005, 50000–55000
CloudXR MicrophoneOutboundUDP49004
CloudXR RTSPOutboundTCP49007

* Directions are from the workstation perspective.

Whitelist all IP addresses that headsets on your network may use — or limit the rules to the IP range you've reserved for headsets via DHCP.