Opening Firewall or Proxy Ports for IBM Video Streaming Broadcasting and Viewing - EU cluster

Overview

In order to broadcast or view streams, you will need to ensure that any firewall is configured to allow traffic on specific ports. A firewall can reside on your local machine, on your router, or as part of your corporate network.

Firewall Settings Needed for Viewing Streams

In order to watch IBM streams you have to create the following stateful firewall rules, assuming you have a regular internet connection:

• Outgoing UDP destination port 53 to your nameserver or any IP for domain name resolution (DNS).
• Outgoing TCP destination port 80, 443 to any IP for web.
• Outgoing TCP destination port 1935 to any IP for streaming (RTMP).
• Outgoing TCP destination ports 8001-8004 to IP ADDRESS RANGES below for web based chat.

Firewall Settings Needed for Broadcasting

In order to Broadcast via IBM Video Streaming you have to create the following stateful firewall rules, assuming you have a regular internet connection. In case you are behind a corporate firewall please ensure your IT department configures the firewall to accommodate these settings:

• Outgoing UDP destination port 53 to your nameserver or any IP for domain name resolution (DNS).
• Outgoing TCP destination port 80, 443 to IP ADDRESS RANGES below for web.
• Outgoing TCP destination port 1935 to IP ADDRESS RANGES below for streaming (RTMP).

Optional: Secure Ingest Setup

If you have secure ingest setup for your account, you will need to open these additional ports:

• Outgoing TCP destination port 4444 to IP ADDRESS RANGES below.
• Outgoing UDP destination port 2070-2090 to IP ADDRESS RANGES below.

IP Address Ranges

List of IP address ranges you have to create firewall filters. In order to ensure a smooth experience, please whitelist all of the following IP address ranges regardless of which locations are closest to your streaming location.

Additional Firewall Settings Needed for ECDN Servers

ECDN servers are deployed behind customer firewalls. These servers act as local caches for the video streaming content. To pull down the content, they need outbound-to-Internet network connectivity. The list below indicates the IP address ranges on the Internet that should be reachable from the ECDN servers. No inbound connectivity from Internet is needed.

Clock Synchronization (Required)

Used for setting the clock on the ECDN servers - outgoing UDP port 123. Clock synchronization is needed for SSL connections to work. Either use a local NTP server(s) or open port 123 to: [0-3].ubuntu.pool.ntp.org

OpenVPN Traffic (Required)

Allow OpenVPN traffic over port 443 to terminator.deepcaching.com. Sometimes, during server upgrades or when customers need additional help in diagnosing the issues, there is a need for ECDN operations team to remotely login to the servers. ECDN Management Portal allows customers to selectively enable/disable a VPN connection from a ECDN server to an IBM Video ECDN server terminator.deepcaching.com in the cloud. When enabled, it allows ECDN operations team to remotely login to this ECDN server, and help with the diagnosis. The VPN tunnel establishes an OpenVPN connection via port 443. This requires the firewall to NOT block such outbound traffic via port 443 to terminator.deepcaching.com.

Child-Parent Proxy Feature (Optional)

Allow 3128 port when child-parent proxy feature is enabled. From the ECDN server version 2.4.2 (20190724) the Child ECDN servers can use Parent ECDNs as proxy for HTTPS calls to connect to Internet. This is an optional feature and can be enabled by IBM via customer request. When this feature is enabled then the port is used by Child servers to connect to the proxy services running on Parent ECDN nodes.

Domain Names

Many enterprise customers use a proxy server to manage the HTTP and HTTPS traffic within their intranet. These proxy servers can become overwhelmed if all video streaming traffic is also channeled through them. To avoid this, proxy servers allow you to define an exclude list of domain names, which allows any traffic to these domains to bypass the proxy server. IBM products uses several domain names as part of its service delivery. These domain names are categorized into:

Control Plane

Such as access to the web portal, support etc. - this traffic may flow via the proxy or bypass it.

• ustream.tv
• *.ustream.tv
• ustreamstatic-a.akamaihd.net
• ustvstaticcdn1-a.akamaihd.net