Allow these outbound. Nothing inbound is required. A Screenly Anywhere screen needs the Screenly and Screenly Anywhere tables; a ScreenlyOS player needs the Screenly and operating system tables, and makes the network checks. What the dashboard itself needs from the browser you manage screens in is a separate, shorter list in Dashboard requirements.
Allow the hostnames themselves. If you resolve them to IP addresses and allow those instead, your deployment will break, because we use Cloudflare in front of our infrastructure and the addresses change.
Screenly
| Hostname | Port | Purpose |
|---|---|---|
api.screenlyapp.com | 443 TCP | Our API |
mtls.screenlyapp.com | 443 TCP | Alternative path to the API |
login.screenlyapp.com | 443 TCP | Access to Screenly services |
us-assets.screenlyapp.com | 443 TCP | Asset storage |
ws.screenlyapp.com | 443 TCP | Web socket, for real-time updates on players |
sentry.screenlyapp.com | 443 TCP | Error tracking and monitoring |
Screenly Anywhere
An Anywhere screen runs inside a browser or an app on the device, so it also fetches the app itself. App-store installs (Google Play, the Amazon Appstore) use the device’s own store hosts, which the device already reaches.
| Hostname | Port | Purpose |
|---|---|---|
anywhere.screenlyapp.com | 443 TCP | The Screenly Anywhere app, opened in a browser or wrapped by the platform apps |
tizen.srly.io | 443 TCP | Installing the app on a Samsung Tizen display, at setup time only |
Operating system (ScreenlyOS)
ScreenlyOS is built on Ubuntu Core, so it needs Canonical’s endpoints as well.
| Hostname | Port | Purpose |
|---|---|---|
snapcraft.io and *.snapcraft.io | 443 TCP | Ubuntu Core |
*.cdn.snapcraft.io | 443 TCP | Ubuntu Core |
*.snapcraftcontent.com | 443 TCP | Ubuntu Core |
login.ubuntu.com | 443 TCP | Ubuntu Core |
myapps.developer.ubuntu.com | 443 TCP | Ubuntu Core |
search.apps.ubuntu.com | 443 TCP | Ubuntu Core |
public.apps.ubuntu.com | 443 TCP | Ubuntu Core |
upload.apps.ubuntu.com | 443 TCP | Ubuntu Core |
serial-vault-partners.canonical.com | 443 TCP | Initial link with Ubuntu’s application store |
ntp.ubuntu.com | 123 UDP and TCP | Time synchronisation |
Network checks (ScreenlyOS)
A player confirms it has a route out before it reports a fault, using two well-known targets.
| Hostname | Protocol | Purpose |
|---|---|---|
google.com | ICMP | Network check |
8.8.8.8 | ICMP | Network check |
If wildcards are not allowed
Some firewalls cannot match on a wildcard. These are the names behind each one, all on port 443 TCP.
In place of *.snapcraftcontent.com
| Hostname |
|---|
storage.snapcraftcontent.com |
canonical-lgw01.cdn.snapcraftcontent.com |
canonical-lcy01.cdn.snapcraftcontent.com |
canonical-lcy02.cdn.snapcraftcontent.com |
canonical-bos01.cdn.snapcraftcontent.com |
cloudfront.cdn.snapcraftcontent.com |
In place of *.cdn.snapcraft.io
| Hostname |
|---|
fastly.cdn.snapcraft.io |
fastly-global.cdn.snapcraft.io |
cloudfront.cdn.snapcraft.io |
canonical-lgw01.cdn.snapcraft.io |
canonical-lcy01.cdn.snapcraft.io |
canonical-bos01.cdn.snapcraft.io |
In place of *.snapcraft.io
| Hostname |
|---|
api.snapcraft.io |
dashboard.snapcraft.io |
You may also need to allow your DNS servers on port 53 UDP.
This list changes as our infrastructure does. If you are building a long-lived firewall rule, check back rather than treating a copy as permanent.