A screen is a client. It reaches out to us, and nothing reaches in.
Outbound only
Screens only make outgoing connections, over ports 443, 123, and 53. Nothing needs to be opened inbound, no port forwarding is involved, and no inbound rule is required for a screen to work.
Connection attempts to a player on port 22 are refused, because there is no SSH access to a ScreenlyOS device at all.
Behind NAT
You can run as many screens as you like behind a single public IP address. There is no per-IP limit and nothing to configure for it.
On a restricted network
If outbound access is filtered, allow the hostnames in Hostnames and ports.
Allow the hostnames, not resolved IP addresses. Our infrastructure sits behind Cloudflare, so the addresses behind those names change. An allowlist built from IPs will work on the day you build it and break later.
You may also need to allow your DNS servers on port 53 UDP. Those normally come from DHCP.
No proxy support
Screens cannot route their traffic through a proxy server. If your network requires one for all outbound traffic, screens need an exception. If this blocks a deployment, talk to us.
Firewall on the device
The ScreenlyOS image does not include a firewall of its own. The device makes outbound connections and refuses inbound ones, so there is nothing on it to configure.
DNSSEC
Our domains, screenlyapp.com and screenly.io, are configured for DNSSEC.
How much traffic to expect
An idle player with no playlist used about 8.6 MB in 24 hours in our own measurement. Lab devices running mixed sample content averaged around 3 GB a month.
Treat both as a starting point rather than a budget. Real usage follows your content: video is large, and a playlist that changes often downloads more than one that does not. Content is cached on the device, so the same asset is not fetched twice.