Firewall Configuration / Zscaler

VSee Calls Behind Zscaler

How to set up Zscaler so VSee calls and sign-ins work.

Overview

Zscaler can disrupt VSee calls (drops, missing audio or video) and sign-ins (unexpected logouts). Step 1 covers call media that goes through VSee's servers. Step 2 covers other VSee traffic.

1. Bypass call media Required

Call audio and video are real-time traffic. They can break when they go through the Zscaler tunnel or inspection.

  1. In the Zscaler Admin Console, go to Infrastructure > Client Connector > IP Bypass > IP-Based > Custom > Add Application.
  2. Add the two applications below. Use each heading as the Name.
  3. Select both applications in your App Profile.

VSee TURN Relay

TURN relays call media when a direct connection is not possible.

ProtocolPortNeedPurpose
UDP3478RequiredRelayed call media
TCP443RequiredFallback when UDP is blocked (TLS)
TCP3478OptionalSecond fallback when UDP is blocked
UDP49152-65535OptionalRelay ports

The relay ports are optional. They are used only on direct calls that go through the other participant's TURN relay. Calls work with UDP 3478 to the TURN servers and UDP 10000 to the video bridges alone.

TURN uses both UDP and TCP, so set Protocol to *. To include the optional relay ports, use 3478, 443, 49152-65535 as the Port.

Zscaler form values
Name
VSee TURN Relay
Protocol
*
Port
3478, 443
IPv4
34.195.60.220, 3.91.120.247, 18.204.252.34, 34.198.123.188, 3.94.156.192, 52.52.31.136, 13.52.175.91, 52.9.63.102, 54.177.39.6, 3.15.110.201, 34.210.252.42, 44.231.34.161

12 addresses

VSee Video Bridge

During a call, media may pass through a video bridge for best performance.

ProtocolPortNeedPurpose
UDP10000RequiredCall media and bridge messages
TCP443OptionalLegacy clients only (VSee Messenger 4.25.x or older, Clinic Meet 9111.x or older); bridge messages, not media. See Legacy clients.

If some users still run those older versions, set Protocol to * and use 10000, 443 as the Port.

Zscaler form values
Name
VSee Video Bridge
Protocol
UDP
Port
10000
IPv4
54.151.67.234, 54.177.202.54, 54.215.26.79, 54.219.55.241, 184.169.198.132, 54.177.84.55, 54.67.10.243, 54.176.204.219, 184.72.28.249, 50.18.195.100, 35.174.23.28, 34.237.10.5, 34.232.244.246, 18.214.46.241, 18.214.51.10, 54.242.133.141, 54.147.165.97, 34.236.235.124, 54.204.161.153, 174.129.121.60

20 addresses

These are VSee's US servers. For users outside the US, also add the international TURN and video bridge servers from Firewall Configuration. IP changes are posted there at least 1 month ahead.

2. Other VSee traffic Recommended

Zscaler SSL inspection can rewrite VSee sign-in and session requests. It can also cut the call connection. To prevent this:

  1. Exclude *.vsee.com and *.vsee.me from SSL inspection.
  2. For a full fix, bypass *.vsee.com and *.vsee.me entirely.
A domain bypass covers web traffic only. You still need step 1 for call media.

If you need IP-based rules for this traffic, see Firewall Configuration.

Still no audio or video?

If 1:1 calls still have no audio or video after both steps, contact VSee support at help@vsee.com. Those calls can send media directly to the other participant instead of through VSee's servers.