If participants are unable to join a session, cannot enable audio/video, or experience poor call quality, the issue is usually related to firewall, proxy, or network restrictions.
Vonage requires outbound network access for signaling and media.
How Vonage traffic works
Vonage uses standard web protocols:
HTTPS / REST (TCP 443) – configuration and logging
Secure WebSockets (WSS over TCP 443) – session signaling
SRTP – real-time audio and video
STUN / TURN – helps devices connect through firewalls and NAT
Important: all connections are outbound only.
No inbound ports or port forwarding are required.
Recommended firewall configuration
Best experience (recommended)
For the fastest connection and best audio/video quality.
Allow outbound:
UDP 3478 (STUN + TURN over UDP)
UDP 1025–65535 (media traffic)
TCP 443 (HTTPS, WebSockets, TURN over TLS)
Balanced setup
Good quality with more restrictive rules.
Allow outbound:
UDP 3478
TCP 443
Minimum requirement
If only web traffic is allowed.
Allow outbound:
TCP 443
Note: limiting traffic to TCP 443 may result in slower connection times and lower video quality. Allowing UDP is strongly recommended.
Proxy requirements
If your network uses a proxy:
Best case: a transparent proxy that allows outbound traffic
Otherwise: the proxy must be configured at the browser or operating system level for HTTPS
Proxies that require authentication may cause issues
PAC file auto-configuration is not supported by Vonage client SDKs
Domain allowlist (if required)
If your organization filters traffic by domain, allow:
*.tokbox.com*.opentok.com*.vonage.com
Vonage cannot provide a fixed list of individual hostnames. Wildcards are required.
Special case: China Relay
If using Vonage China Relay, also allow:
websocketproxy.nexmoproxy.cn
Quick troubleshooting checklist
Ask the participant or their IT team to confirm:
Outbound TCP 443 is allowed
Outbound UDP 3478 is allowed (recommended)
Outbound UDP 1025–65535 is allowed for best quality
Any proxy is transparent or properly configured for HTTPS
Required wildcard domains are allowlisted