Network Allowlist for School IT

This page is meant to be shared with the venue or school IT department before your event. It lists the outbound connections the AV cart needs so streaming, remote support, and our web apps work on a restrictive/filtered network. The cart only ever makes outbound connections — no inbound ports need to be opened.

How to use this page

Give the IT contact this page (or the URL https://docs.fimav.us/docs/it-allowlist) and ask them to allow the domains and ports below for the AV cart’s IP/MAC address.

If they can only do one thing, the single most impactful change is: allow all outbound TCP 443 (HTTPS), plus outbound TCP 1935 and 1937 (RTMP/RTMPS streaming). That covers the large majority of what we need. The tables below give the specific hostnames for stricter environments.

Live streaming

The stream goes out over RTMP/RTMPS. If these ports are blocked the stream will not start (see Stream Won’t Start).

ServiceDomainsPorts
Restream (primary ingest)restream.io, *.restream.io, live.restream.ioTCP 1935 (RTMP), TCP 1937 (RTMPS), TCP 443
YouTube Liveyoutube.com, *.youtube.com, studio.youtube.com, a.rtmp.youtube.com, b.rtmp.youtube.com, upload.youtube.com, *.googlevideo.comTCP 1935 (RTMP), TCP 443 (RTMPS + caption ingestion)

Remote support (staff access to the cart)

AV staff remotely control carts to fix streams and configuration. At least one of these must work or we lose the ability to help you during the event.

ServiceDomainsPorts
TeamViewer*.teamviewer.comTCP 5938 (primary), fallback TCP 443 / 80, UDP 5938
Tailscale*.firstinmichigan.usTCP 443, UDP 41641 (direct), UDP 3478 (STUN)

FiM AV web apps and services

ServiceDomainsPorts
FiM AV Docs (this site)docs.fimav.usTCP 443
FiM Queueing / stream graphics / Audience Displayq.fimav.us, *.fimav.usTCP 443
First in Michiganfirstinmichigan.us, firstinmichigan.orgTCP 443

Google (Drive, accounts, captions)

The cart signs into a Google Workspace account (fimvideo<#>@firstinmichigan.org) and syncs event assets over Google Drive for Desktop. The recommended live-captions engine (“Google V2”) also uses Google’s speech API.

PurposeDomainsPorts
Google sign-inaccounts.google.com, *.google.comTCP 443
Google Drive for Desktopdrive.google.com, drive.usercontent.google.com, *.googleapis.com, *.googleusercontent.comTCP 443
Google Docs (some resources)docs.google.comTCP 443
Captions transcription (Google V2)*.googleapis.com, speech.googleapis.comTCP 443

Microsoft / OneDrive

PurposeDomainsPorts
OneDrive file synconedrive.live.com, *.onedrive.com, *.sharepoint.com, login.microsoftonline.com, *.live.comTCP 443

Communications

ServiceDomainsPorts
Slack (first-in-michigan + frc-support workspaces)slack.com, *.slack.com, first-in-michigan.slack.com, *.slack-edge.com, *.slack-msgs.com, wss-*.slack.comTCP 443 (incl. WebSocket)

FIRST / scoring

ServiceDomainsPorts
FIRST Inspiresfirstinspires.org, www.firstinspires.org, *.firstinspires.orgTCP 443
The Blue Alliance (stream/scoring links)thebluealliance.com, www.thebluealliance.comTCP 443
FTC Live scoringgithub.com (scorekeeper updates), ftc-api.firstinspires.org, *.firstinspires.orgTCP 443
FRC FMS cloud sync*.firstinspires.orgTCP 443

Port summary

For IT teams that filter by port rather than hostname:

PortProtocolUsed for
443TCPHTTPS — nearly everything (web apps, Google, Slack, RTMPS, remote support fallback)
1935TCPRTMP streaming ingest (Restream / YouTube)
1937TCPRTMPS streaming ingest (Restream secure variant)
80TCPHTTP (some updates / TeamViewer fallback)
5938TCP/UDPTeamViewer remote support
41641UDPTailscale direct connections
3478UDPSTUN (Tailscale NAT traversal)