# Pairio on a company network: What your IT team needs to allow.

Pairio connects two Macs directly when it can. Some company networks block that, and then the call goes through a relay instead. If calls don’t connect at work, send this page to your IT team.

## The short version

- Allow outbound connections to `pairio.app` on TCP 443.
- Allow outbound connections to `turn.cloudflare.com` on UDP 3478 and 443, and TCP 3478, 80, 5349 and 443.
- Don’t decrypt or proxy the traffic to `turn.cloudflare.com`.

## What Pairio connects to

### Pairio’s server

- **Address**: `pairio.app`
- **Ports**: TCP 443: HTTPS, and one WebSocket that stays open while the app runs
- **Used for**: Signing in, contacts, starting and joining calls, and app updates

### The other person’s Mac, directly

- **Address**: The other Mac, or the public address of its network
- **Ports**: UDP, from and to ports 1024 to 65535
- **Used for**: The call itself: sound, video, the shared screen and remote control. A firewall that lets outbound UDP and its replies through needs nothing else for this.

### Address lookup (STUN)

- **Addresses**: `stun.l.google.com` `stun1.l.google.com` `stun.cloudflare.com` `stun.services.mozilla.com`
- **Ports**: UDP 19302 for the two Google servers, UDP 3478 for the other two
- **Used for**: Finding the direct route between the two Macs

### The relay

- **Address**: `turn.cloudflare.com`
- **Ports**: UDP 3478 and 443; TCP 3478 and 80; TLS over TCP 5349 and 443
- **Used for**: The call, when the direct route is blocked. Pairio tries UDP first, then TCP, then TLS, and uses the first that gets through.

### Crash reports (optional)

- **Address**: `*.ingest.de.sentry.io`
- **Ports**: TCP 443
- **Used for**: Crash reports, while “Share crash reports and diagnostics” is on in Pairio’s settings. Blocking it breaks nothing.

## Allow the relay by name

Allow `turn.cloudflare.com` by its name if your firewall can.

If it only takes addresses, allow all four that Cloudflare uses for it: `141.101.90.1`, `162.159.207.1`, `2a06:98c1:3200::1` and `2606:4700:48::1`. Cloudflare may change them. It changes the name first, and asks you to update a list of addresses within 14 days. See [Cloudflare’s questions and answers on its relay](https://developers.cloudflare.com/realtime/turn/faq/).

## Don’t decrypt or proxy the relay

Calls are end-to-end encrypted between the two Macs. The relay passes the encrypted packets on and cannot read them. It runs on Cloudflare’s network, at the Cloudflare location closest to each Mac.

A firewall that decrypts and re-encrypts TLS traffic breaks the relay on ports 5349 and 443, because Pairio accepts only the relay’s own certificate. Add `turn.cloudflare.com` to the exceptions.

Pairio connects to the relay directly, never through a web proxy. If traffic can leave your network only through a proxy, let `turn.cloudflare.com` bypass it.

## Check that it works

Start a call from inside your network. If it connects, you’re done.

If Pairio says it couldn’t connect, email us with roughly when you tried. We can see how the call tried to connect, and we’ll tell you what was blocked.

Questions from IT?

Write to us. We build Pairio, and we answer technical questions ourselves.

[hello@pairio.app](mailto:hello@pairio.app)

Usually a reply within a day.

Something else?

Pricing, supported Macs and where your data is kept.

[Back to the Help Center](https://pairio.app/help)