Reference

Network Requirements

Allow the hosts and ports that EnderDash uses for connections and downloads.

Allowlist summary

Use this table to create firewall, egress, and network rules.

Host or endpoint	Required when	Protocols and ports	Purpose
`app.enderdash.com`	Always	TCP `443`	EnderDash application traffic.
`signaling.enderdash.com`	Always, unless you override the signaling host	TCP `443`	Signaling WebSocket at `wss://signaling.enderdash.com/ws`.
`turn.cloudflare.com`	Recommended for restrictive networks	UDP `3478`, TCP `80`, `3478`, `443`, `5349`	TURN relay fallback for a blocked direct WebRTC connection.
`stun.cloudflare.com`	Recommended for direct connectivity	UDP `3478`	STUN discovery.
`checkip.amazonaws.com`	Optional	TCP `443`	Agent-owned public-IP discovery for metadata and easier NAT debugging.
`downloads.enderdash.com`	Optional	TCP `443`	Agent downloads and update checks.
`enderdash.com`	Optional	TCP `443`	Docs and marketing site. Not required for the running agent.

Custom signaling host

If you override signalingUrl in the agent configuration, allow that host instead of signaling.enderdash.com.

Game OAuth requires browser access to oauth.enderdash.com:443, including its authorize live WebSocket. Its Turnstile check requires challenges.cloudflare.com:443. The relying application's backend also needs the OAuth host for discovery, token exchange, keys, and userinfo.

Account OAuth uses app.enderdash.com:443. Hosted player forms use verify.enderdash.com:443 and hCaptcha. These flows do not require an additional inbound management port on the game server. The player still needs access to the game server's normal game port.

Minimum egress sets

Register an agent and use signaling

Allow outbound access to:

app.enderdash.com:443
signaling.enderdash.com:443

Connect a browser from a restrictive network

Also allow outbound access to:

turn.cloudflare.com
stun.cloudflare.com

If the network blocks direct traffic, these hosts provide WebRTC discovery and relay support.

Direct connectivity rules

A domain allowlist does not guarantee a direct connection. After signaling, the browser and agent try different IP addresses and ports.

For a direct connection:

An FQDN allowlist is not enough.
Allow the offered ports through the firewall or router.
By default, the agent selects ports dynamically.
Use a fixed range for predictable ports.

Example:

restrictPorts: true
webrtcMinPort: 10000
webrtcMaxPort: 10010

For a fixed range, allow UDP and TCP on all ports in the range.

Set a public address

The agent usually finds its public IP. Some NAT setups block the request or return the wrong address.

In these environments, set the public address manually:

advertisePublicAddress: true
publicAddress: "203.0.113.50"

Use the public IP that forwards traffic to the runtime.

Optional access

The runtime does not need enderdash.com.
If you can use a relay, you do not need checkip.amazonaws.com for public-IP information.
You do not need other browser-to-agent hostnames. The browser uses the runtime's reachable IP addresses and ports.

Was this page helpful?

Send a quick note if anything is missing or unclear.

Last updated on

Agent Commands

Use the `enderdash` console commands on supported agent runtimes.

Container Platforms

Learn what EnderDash supports on Docker, Podman, Docker Compose, and Kubernetes.