# What the network needs


> Screens connect outbound only, work behind NAT, and need an allowlist of hostnames rather than IP addresses on a restricted network.

A screen is a client. It reaches out to us, and nothing reaches in. This applies to every Screenly screen; the sections marked ScreenlyOS describe the player operating system, and do not apply to a Screenly Anywhere screen running inside another system.

## Outbound only

Screens only make outgoing connections, over ports 443, 123, and 53. Nothing needs to be opened inbound, no port forwarding is involved, and no inbound rule is required for a screen to work.

On ScreenlyOS, connection attempts to a player on port 22 are refused, because there is no SSH access to the device at all.

## Behind NAT

You can run as many screens as you like behind a single public IP address. There is no per-IP limit and nothing to configure for it.

## On a restricted network

If outbound access is filtered, allow the hostnames in [Hostnames and ports](/docs/it-requirements/reference/hostnames-and-ports/). A Screenly Anywhere screen needs the Screenly entries only; a ScreenlyOS player needs the operating system entries as well.

> [!IMPORTANT]
> Allow the hostnames, not resolved IP addresses. Our infrastructure sits behind Cloudflare, so the addresses behind those names change. An allowlist built from IPs will work on the day you build it and break later.

You may also need to allow your DNS servers on port 53 UDP. Those normally come from DHCP.

## No proxy support (ScreenlyOS)

ScreenlyOS players cannot route their traffic through a proxy server. If your network requires one for all outbound traffic, players need an exception. If this blocks a deployment, [talk to us](https://support.screenly.io/hc/en-us/requests/new). A Screenly Anywhere screen uses whatever proxy the device it runs on is configured with.

## Firewall on the device (ScreenlyOS)

The ScreenlyOS image does not include a firewall of its own. The device makes outbound connections and refuses inbound ones, so there is nothing on it to configure.

## DNSSEC

Our domains, `screenlyapp.com` and `screenly.io`, are configured for DNSSEC.

## How much traffic to expect

An idle ScreenlyOS player with no playlist used about 8.6 MB in 24 hours in our own measurement. Lab devices running mixed sample content averaged around 3 GB a month.

Treat both as a starting point rather than a budget. Real usage follows your content: video is large, and a playlist that changes often downloads more than one that does not. Content is cached on the device, so the same asset is not fetched twice.

Configuring a ScreenlyOS player's own connection, such as Wi-Fi, a static IP, or 802.1X, is under [ScreenlyOS](/docs/screenlyos/networking/). A Screenly Anywhere screen takes its network settings from the system it runs on.