Chronus in-app video calling runs on Twilio Programmable Video. Share this article with your IT and network team and have them configure these rules before rolling out video calls.
Outbound only — every connection starts on the user's device. No inbound rules are needed.
Scoped to Twilio — every rule names a Twilio host or an IP range Twilio publishes.
Quality depends on it — blocked UDP forces media over TCP, adding lag and freezes.
Check Your Network Connectivity
Step 1: Open the Chronus Video Diagnostics page from your corporate network or VPN.
If the report shows no issues, no further action is needed.
If the report indicates connectivity issues, continue to Step 2.
Step 2: Ask your IT or network team to add the outbound allowlist and the firewall and proxy settings below, using the column that matches the region your Chronus program is hosted in.
Step 3: Once the rules are in place, open the Chronus Video Diagnostics page again from your corporate network or VPN to confirm connectivity and call quality.
Outbound Allowlist
Purpose | Protocol / Port | Chronus program hosted in US / AU | Chronus program hosted in EU |
Signaling Call setup and control | TCP 443 (WSS) | global.vss.twilio.com | de1.vss.twilio.com |
SDK gateway Client connectivity | TCP 443 (WSS) | sdkgw.us1.twilio.com | sdkgw.us1.twilio.com |
STUN Direct path through NAT | UDP 3478 | global.stun.twilio.com *.stun.twilio.com | global.stun.twilio.com *.stun.twilio.com |
TURN Relay when the direct path fails | UDP 3478 TCP 3478 TCP 443 (TLS or plain) | global.turn.twilio.com *.turn.twilio.com | global.turn.twilio.com *.turn.twilio.com |
Media servers Audio, video and screen share (IPv4 only) | UDP 10,000 – 60,000 UDP 3478 TCP 443 (TLS) | Recommended: all regions' IP ranges Minimum: the IP ranges for your users' regions | Region de1 only: 52.59.186.0/27 18.195.48.224/27 18.156.18.128/25 |
TURN ports reflect the relay servers Chronus issues to browsers through Twilio's Network Traversal Service.
Media server IP ranges come from Twilio's IP addresses page (retrieved 22 Oct 2026). Twilio can change these ranges, so check that page for the current list.
Firewall and Proxy Settings
Exclude Twilio from TLS inspection and deep packet inspection (DPI).
Turn off SIP ALG in the media path.
Set the WebSocket idle timeout to 300 seconds or more.
Let Twilio UDP and WSS traffic bypass proxies and VPNs.
Allow STUN, TURN and DTLS application rules on next-generation firewalls (NGFWs).
Expected Call Quality
Call quality depends on which paths your network allows:
Quality | What's allowed |
Optimal | UDP 10,000 – 60,000. Best quality. |
Acceptable | UDP 3478 relay only. Adds under 50 ms. |
Degraded | TCP relay only. Adds over 50 ms. |
No connection | Signaling is blocked, or there is no media path. |
If you still see connectivity issues after applying these rules, or aren't sure which region your Chronus program is hosted in, reach out to Chronus Support.