# Zscaler
URL: https://developers.vsee.io/guides/firewall-config/zscaler

Firewall Configuration / Zscaler

### VSee Calls Behind Zscaler
How to set up Zscaler so VSee calls and sign-ins work.

### Overview
Zscaler can disrupt VSee calls (drops, missing audio or video) and sign-ins (unexpected logouts). Step 1 covers call media that goes through VSee's servers. Step 2 covers other VSee traffic.

### 1. Bypass call media Required
Call audio and video are real-time traffic. They can break when they go through the Zscaler tunnel or inspection.
- In the Zscaler Admin Console, go to Infrastructure > Client Connector > IP Bypass > IP-Based > Custom > Add Application.
- Add the two applications below. Use each heading as the Name.
- Select both applications in your App Profile.

### VSee TURN Relay
TURN relays call media when a direct connection is not possible.
Protocol | Port | Need | Purpose
UDP | 3478 | Required | Relayed call media
TCP | 443 | Required | Fallback when UDP is blocked (TLS)
TCP | 3478 | Optional | Second fallback when UDP is blocked
UDP | 49152-65535 | Optional | Relay ports

The relay ports are optional. They are used only on direct calls that go through the other participant's TURN relay. Calls work with UDP 3478 to the TURN servers and UDP 10000 to the video bridges alone.
TURN uses both UDP and TCP, so set Protocol to *. To include the optional relay ports, use 3478, 443, 49152-65535 as the Port.
Zscaler form values
Name: VSee TURN Relay
Protocol: *
Port: 3478, 443
IPv4: 34.195.60.220, 3.91.120.247, 18.204.252.34, 34.198.123.188, 3.94.156.192, 52.52.31.136, 13.52.175.91, 52.9.63.102, 54.177.39.6, 3.15.110.201, 34.210.252.42, 44.231.34.161
12 addresses

### VSee Video Bridge
During a call, media may pass through a video bridge for best performance.
Protocol | Port | Need | Purpose
UDP | 10000 | Required | Call media and bridge messages
TCP | 443 | Optional | Legacy clients only (VSee Messenger 4.25.x or older, Clinic Meet 9111.x or older); bridge messages, not media. See Legacy clients.

If some users still run those older versions, set Protocol to * and use 10000, 443 as the Port.
Zscaler form values
Name: VSee Video Bridge
Protocol: UDP
Port: 10000
IPv4: 54.151.67.234, 54.177.202.54, 54.215.26.79, 54.219.55.241, 184.169.198.132, 54.177.84.55, 54.67.10.243, 54.176.204.219, 184.72.28.249, 50.18.195.100, 35.174.23.28, 34.237.10.5, 34.232.244.246, 18.214.46.241, 18.214.51.10, 54.242.133.141, 54.147.165.97, 34.236.235.124, 54.204.161.153, 174.129.121.60
20 addresses

These are VSee's US servers. For users outside the US, also add the international TURN and video bridge servers from Firewall Configuration. IP changes are posted there at least 1 month ahead.

### 2. Other VSee traffic Recommended
Zscaler SSL inspection can rewrite VSee sign-in and session requests. It can also cut the call connection. To prevent this:
- Exclude *.vsee.com and *.vsee.me from SSL inspection.
- For a full fix, bypass *.vsee.com and *.vsee.me entirely.

A domain bypass covers web traffic only. You still need step 1 for call media.
If you need IP-based rules for this traffic, see Firewall Configuration.

### Still no audio or video?
If 1:1 calls still have no audio or video after both steps, contact VSee support at help@vsee.com. Those calls can send media directly to the other participant instead of through VSee's servers.