...
...
...
...
...
...
Network Security Diagram
Simplified Rules
If *.vsee.com can be whitelisted, please add
...
this into your firewall rules with the following ports:
...
Purpose | Protocol: Port | Detail Servers |
VSee Directory, Relay, Call management, Diagnostics, etc |
...
Call presence and reporting
...
. Required for VSee Messenger authentication, address book services, establishing video calls, video packets relay, VSee Messenger chat communication. Measure bandwidth for video quality adjustment |
|
|
...
Network route for peer-to-peer UDP (Optional)
For optimal performance: Allowing for VSee endpoints to directly communicate with each other. This will improve A/V performance and reduce load on firewalls and web proxies.
...
UDP
...
any host
Call presence and reporting Update VSee user’s status, e.g. Offline, Online, In a call, Busy, etc. |
|
|
Cloud recording service |
...
HTTPS -- TLS: 443
...
s3.amazonaws.com
...
Measure bandwidth for video quality adjustment
...
HTTP(S): 80, 443
...
http://bw.vsee.com
Network Security Diagram
...
(Optional, depends on contract) Record video calls performed via VSee Messenger and/or in-browser calls. The calls will be recorded on the server side and will be available via a cloud link. |
|
|
Detailed Rules (US Customers)
Please note the servers listed below are for calls within the United States only.
If *.vsee.com cannot be whitelisted, the following subdomains and ports are required.
...
Purpose | Protocol: Port |
|---|
...
Servers | IP Addresses | |||
|---|---|---|---|---|
MESSENGER SERVICE | ||||
VSee Directory | ||||
...
Authentication and address book services for VSee Messenger and in-browser call and chat. |
|
|---|
...
|
...
|
|
|
...
|
...
|
...
|
...
Call management
...
HTTPS -- TLS 1.2: 443
...
api.vsee.com -- 13.52.171.113, 52.9.150.124, 184.72.21.195client.vsee.com -- 13.52.171.113, 52.9.150.124, 184.72.21.195
...
Chat file transfer
...
HTTPS -- TLS 1.2: 443
...
assets.vsee.com -- 13.52.171.113, 52.9.150.124, 184.72.21.195
...
Call presence and reporting
...
HTTPS: 443
...
*.pubnub.comvsee-activeapi.firebaseio.com
...
Messenger diagnostics
...
HTTPS -- TLS 1.2: 443
...
ironmq.vsee.com -- 13.52.171.113, 52.9.150.124, 184.72.21.195
...
Messenger update service
...
HTTPS -- TLS 1.2: 443
...
cloudfront.vsee.com
...
Cloud recording (optional depends on contract)
...
HTTPS -- TLS: 443
...
s3.amazonaws.com
...
Bandwidth Test
Measure bandwidth for video quality adjustment
...
HTTP: 80HTTPS: 443
...
http://bw.vsee.com
...
Profile management (optional)
...
HTTPS -- TLS 1.2: 443
...
http://vsee.comhttp://my.vsee.com -- 13.52.171.113, 52.9.150.124, 184.72.21.195
...
Network route for peer-to-peer UDP (recommended)
For optimal performance: Allowing for VSee endpoints to directly communicate with each other. This will improve A/V performance and reduce load on firewalls and web proxies. VSee Messenger will attempt to bind local UDP port 6000-6255 but router might allocate other public port.
...
Inbound and outbound for UDP on any port
...
Any hosts
...
Discover network route for peer-to-peer UDP (optional)
...
UDP (STUN): 3478, 6000, 6001, 6256
...
http://stun01.vsee.com -- 50.18.91.143stun02.vsee.com -- 52.52.56.79http://stun-map01.vsee.com -- 50.18.91.143stun-map02.vsee.com -- 52.52.56.79http://net.vsee.comhttp://net-1.vsee.com -- 50.18.91.143net-2.vsee.com -- 52.52.56.79
...
US TURN Servers **
Relay packets in case no peer-to-peer connection can be established.
...
UDP: 3478TCP: 3478TLS: 443UDP: 49152 -- 65535(TURN allocated)
...
| |||
US TURN Servers |
|
|
|
|---|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
Region Identification Service |
|---|
...
VSee user’s region |
|---|
...
and to choose the optimal video bridge server for better call performance. |
|
|
|---|
...
| ||
Video Bridge |
|
|---|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
|
...
|
...
|
...
|
...
|
...
...
|
...
...
|
...
...
|
...
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
Test new video bridge connectivity here
...
US Relays
Relay packets in case no peer-to-peer connection and no TURN connection can be established.
...
UDP: 6000, 1853HTTP:80HTTPS: 443
...
cl-relay.vsee.comusw01-rel.vsee.com -- 54.215.19.55usw02-rel.vsee.com -- 184.72.50.82use01-rel.vsee.com -- 107.20.144.226use02-rel.vsee.com -- 23.23.244.20
** Subject to change with at least 1 month of prior notice. We might be adding more video bridge / TURN servers for better performance
Performance Impact of Web Proxies: The VSee client can connect to all the above hosts via a Web Proxy. However, A/V performance will be dependent on the Web Proxy’s capacity. Some factors that might affect performance through a proxy are:
Load on the Web Proxy
Prioritization of persistent HTTP(S) connections through the proxy.
For optimal performance:
...
The Web Proxy should allow persistent HTTP(S) connections.
...
Messenger update service Automated check for new versions of VSee Messenger |
|
| ||
|---|---|---|---|---|
Profile management Managing VSee user profile, changing password, etc. |
|
| ||
|
| |||
Messenger diagnostics Diagnostic information gathered by VSee Messenger |
|
|
| |
CLINIC SERVICE | ||||
Clinic web and API cluster Basic Clinic functionality |
|
|
| |
Call presence and reporting Update VSee users' presence status. |
|
| ||
| ||||
|
| |||
OPTIONAL FIREWALL RULES | ||||
MFA / SSO (Depends on contract) Enables login with MFA or using an SSO identity provider. | TCP: 443 |
| ||
Cloud recording (Depends on contract) Record video calls performed via VSee Messenger and/or in-browser calls. The calls will be recorded on the server side and will be available via a cloud link. |
|
| ||
Connectivity Testing Service A set of test tools to define if the VSee user’s network conditions are good enough for video calls, checking the reachability of critical VSee infrastructure. |
|
|
| |
Detailed Rules (International Customers)
For international customers, please apply all rules in the US Customers section as well as the following:
Purpose | Protocol: Port | Detail Servers |
|---|
...
International Relays
...
UDP: 6000, 1853HTTP:80HTTPS: 443
cl-relay.vsee.com
...
...
euw01-rel.vsee.com -- 54.217.225.38
International TURN servers |
|
|---|
...
, |
...
|
|
|
...
|
...
|
...
|
...
|
|
...
|
...
| |||
Video Bridge |
|
|
|---|
...
Testing VSee Connectivity
...
You can use the following page to test for basic VSee connectivity: VSee Network Test Page
...
If any of the test above result in failure, you need to resolve it first.
...
|
Proxy Servers
Many organizations utilize proxy servers with their networks. However, as VSee network traffic is already encrypted, passing this traffic through a proxy server does not make it any more secure. On the other hand, proxy servers can introduce performance problems. Proxy servers can introduce latency and packet loss, which can degrade audio and video quality where real-time streams are essential. Thus, bypassing proxies for VSee traffic is recommended as routing through all traffic through a proxy server might impact connectivity and A/V performance.
If proxy servers can not be bypassed, VSee services can connect to the above hosts via a proxy server. We recommend the following for better performance with a proxy server:
Proxy servers should allow persistent TCP connections.
Proxy servers should be configured to allow UDP traffic to the VSee TURN Servers at port 3478 and the Video Bridges at port 10000 to proceed directly.
Testing VSee Connectivity
VSee provides a suite of tools to help test that firewall rules are configured appropriately. Please note that only a subset of the requirements listed above are tested by these tools. It is important to ensure that the firewall rules listed above are followed, even if these tests pass. Failing to follow
...
Update on 4 Jun 2021:
Total of 20 video bridges will be available in Aug 1, 2021
IP addresses are added for convenience
Update on 16 Feb 2021:
Added 5 more video bridges
jvb04-nvir.vsee.com , jvb01-ncal.vsee.com, jvb02-ncal.vsee.com, jvb03-ncal.vsee.com, jvb04-ncal.vsee.comRemoved port 4443, 10001-20000 range for video bridge
Removed US Relays
usw03-rel.vsee.com, use03-rel.vsee.com, use04-rel.vsee.com, use05-rel.vsee.comRemoved International Relays
euw02-rel.vsee.comRemoved International TURN server
cl-coturn-sn01.vsee.com
Update on 13 July 2020:
...
Updated network connectivity test URL
...
Added 6001, 6256 port for STUN
...
Added note for new TURN, Video bridge will be added in with 1 month notice
...
Added region.vsee.com
Update on 8 Jun 2020:
Added
cl-coturn-ohio01.vsee.com, cl-coturn-ohio02.vsee.com, cl-coturn-oregon01.vsee.com, cl-coturn-oregon02.vsee.cominto TURN server list
Update on 1 Jun 2020:
Added
UDP: 49152 -- 65535 (TURN allocated)to TURN protocol / port info
...
the firewall configuration requirements may cause issues such as intermittent bad call quality or dropped calls.
Test | URL |
|---|---|
Basic VSee connectivity | |
TURN connectivity | |
Other tools |
Outbound Connections
VSee services may occasionally need to connect with your systems for webhooks and callbacks, or to securely transfer patient / encounter data through SFTP, etc. Here are the lists of IP addresses that should be whitelisted.
Messenger Service
| Code Block |
|---|
13.52.171.113
52.9.150.124
184.72.21.195
184.72.47.83
54.241.101.173 |
Clinic Service
| Code Block |
|---|
13.52.7.6
13.56.46.159
52.52.174.230
54.177.111.163
13.52.58.237
18.144.134.162
54.241.243.156
54.176.136.131
13.56.219.50
13.56.202.120
13.56.70.155
50.18.137.251
13.52.25.116 |
Updates
Update on 1 Aug 2023
Updated correct list of Clinic Service IPs.
The following IPs are no longer valid
54.153.119.24, 18.144.69.7, 52.53.171.200, 54.176.88.134, 18.144.8.250, 52.53.190.38, 54.177.38.2, 54.215.4.54, 54.193.243.179, 184.72.50.250
Update on 13 July 2023
Relayout content, separate out IP addresses for easy copy & paste
Removed legacy relay servers
Added in Singapore Video bridge
Added dedicated section for Testing VSee Connectivity
Added Outbound Connections section