# Zscaler
URL: https://developers.vsee.com/guides/firewall-config/zscaler

Firewall Configuration / Zscaler

### VSee Calls Behind Zscaler
How to set up Zscaler so VSee calls and sign-ins work.

### Overview
Zscaler can disrupt VSee calls (drops, missing audio or video) and sign-ins (unexpected logouts). Step 1 covers call media that goes through VSee's servers. Step 2 covers other VSee traffic.

### 1. Bypass call media Required
Call audio and video are real-time traffic. They can break when they go through the Zscaler tunnel or inspection.
- In the Zscaler Admin Console, go to Infrastructure > Client Connector > IP Bypass > IP-Based > Custom > Add Application.
- Add the two applications below. Use each heading as the Name.
- Select both applications in your App Profile.

### VSee TURN Relay
TURN relays call media when a direct connection is not possible.
Protocol | Port | Need | Purpose
UDP | 3478 | Required | Relayed call media.
TCP | 443 | Required | Fallback when UDP is blocked.
UDP | 49152-65535 | Optional | Relay ports.

TURN uses both UDP and TCP, so set Protocol to *. To include the optional relay ports, use 3478, 443, 49152-65535 as the Port.
Zscaler form values
Name: VSee TURN Relay
Protocol: *
Port: 3478, 443
IPv4: 34.195.60.220, 3.91.120.247, 18.204.252.34, 34.198.123.188, 3.94.156.192, 52.52.31.136, 13.52.175.91, 52.9.63.102, 54.177.39.6, 3.15.110.201, 34.210.252.42, 44.231.34.161
12 addresses

### VSee Video Bridge
During a call, media may pass through a video bridge for best performance.
Protocol | Port | Need | Purpose
UDP | 10000 | Required | Call media through the video bridge.

Zscaler form values
Name: VSee Video Bridge
Protocol: UDP
Port: 10000
IPv4: 54.151.67.234, 54.177.202.54, 54.215.26.79, 54.219.55.241, 184.169.198.132, 54.177.84.55, 54.67.10.243, 54.176.204.219, 184.72.28.249, 50.18.195.100, 35.174.23.28, 34.237.10.5, 34.232.244.246, 18.214.46.241, 18.214.51.10, 54.242.133.141, 54.147.165.97, 34.236.235.124, 54.204.161.153, 174.129.121.60
20 addresses

These are VSee's US servers. For users outside the US, also add the international TURN and video bridge servers from Firewall Configuration. IP changes are posted there at least 1 month ahead.

### 2. Other VSee traffic Recommended
Zscaler SSL inspection can rewrite VSee sign-in and session requests. It can also cut the call connection. To prevent this:
- Exclude *.vsee.com and *.vsee.me from SSL inspection.
- For a full fix, bypass *.vsee.com and *.vsee.me entirely.

A domain bypass covers web traffic only. You still need step 1 for call media.
If you need IP-based rules for this traffic, see Firewall Configuration.

### Still no audio or video?
If 1:1 calls still have no audio or video after both steps, contact VSee support at help@vsee.com. Those calls can send media directly to the other participant instead of through VSee's servers.