Pairio Pairio
Features Pricing About us Sign in
Download

Help Center

Pairio on a company network:
What your IT team needs to allow.

Pairio connects two Macs directly when it can. Some company networks block that, and then the call goes through a relay instead. If calls don’t connect at work, send this page to your IT team.

The short version

  • Allow outbound connections to pairio.app on TCP 443.
  • Allow outbound connections to turn.cloudflare.com on UDP 3478 and 443, and TCP 3478, 80, 5349 and 443.
  • Don’t decrypt or proxy the traffic to turn.cloudflare.com.

What Pairio connects to

Pairio’s server

Address
pairio.app
Ports
TCP 443: HTTPS, and one WebSocket that stays open while the app runs
Used for
Signing in, contacts, starting and joining calls, and app updates

The other person’s Mac, directly

Address
The other Mac, or the public address of its network
Ports
UDP, from and to ports 1024 to 65535
Used for
The call itself: sound, video, the shared screen and remote control. A firewall that lets outbound UDP and its replies through needs nothing else for this.

Address lookup (STUN)

Addresses
stun.l.google.com
stun1.l.google.com
stun.cloudflare.com
stun.services.mozilla.com
Ports
UDP 19302 for the two Google servers, UDP 3478 for the other two
Used for
Finding the direct route between the two Macs

The relay

Address
turn.cloudflare.com
Ports
UDP 3478 and 443; TCP 3478 and 80; TLS over TCP 5349 and 443
Used for
The call, when the direct route is blocked. Pairio tries UDP first, then TCP, then TLS, and uses the first that gets through.

Crash reports (optional)

Address
*.ingest.de.sentry.io
Ports
TCP 443
Used for
Crash reports, while “Share crash reports and diagnostics” is on in Pairio’s settings. Blocking it breaks nothing.

Allow the relay by name

Allow turn.cloudflare.com by its name if your firewall can.

If it only takes addresses, allow all four that Cloudflare uses for it: 141.101.90.1, 162.159.207.1, 2a06:98c1:3200::1 and 2606:4700:48::1. Cloudflare may change them. It changes the name first, and asks you to update a list of addresses within 14 days. See Cloudflare’s questions and answers on its relay.

Don’t decrypt or proxy the relay

Calls are end-to-end encrypted between the two Macs. The relay passes the encrypted packets on and cannot read them. It runs on Cloudflare’s network, at the Cloudflare location closest to each Mac.

A firewall that decrypts and re-encrypts TLS traffic breaks the relay on ports 5349 and 443, because Pairio accepts only the relay’s own certificate. Add turn.cloudflare.com to the exceptions.

Pairio connects to the relay directly, never through a web proxy. If traffic can leave your network only through a proxy, let turn.cloudflare.com bypass it.

Check that it works

Start a call from inside your network. If it connects, you’re done.

If Pairio says it couldn’t connect, email us with roughly when you tried. We can see how the call tried to connect, and we’ll tell you what was blocked.