School Cloud Parents Evening - Smoothwall Turn UDP Error

[Benjaminbl12]

Hello all

 

We've got a parents evening this week and we are using School Cloud's Parents Evening video service. We are using Smoothwall as a filtering partner but when running the test, it fails on Turn UDP Connection.

 

I've so far unblocked the following:

 

global.vss.twilio.com

sdkgw.us1.twilio.com

global.twilio.com

twilio.com

 

Smoothwall so far have suggested to make a GPO exception (*.twilio.com) however this can't be the case for all schools using this system and Smoothwall surely? Any help would be greatly appreciated!

 

Thanks,

Ben

[howartp]

Have you followed http://www.edugeek.net/forums/smoothwall-direct-support/217557-parents-evening-software-being-blocked-smoothwall.html

 

That in turn points you to https://support.parentseveningsystem.co.uk/article/825-video-appointments-network-requirements

[Benjaminbl12]

I did and I've been to that article by School Cloud. We shouldn't need to unblock all those IP Addresses... There must be a different way around all this!

[SchoolCloudSystems]

I did and I've been to that article by School Cloud. We shouldn't need to unblock all those IP Addresses... There must be a different way around all this!

 

I'm afraid those IP addresses do need to be allowed over TCP 443, UDP 3478, and UDP 10,000 - 60,000.

 

Video Appointments are built using WebRTC, which uses TURN servers to relay media traffic where a direct peer-to-peer connection between each party isn't possible (which often isn't the case due to NAT/firewalls). This requires TCP 443 or UDP 3478 (depending on the browser) to connect to the TURN server to set up the connection, and then an ephemeral port is assigned in the 10,000 - 60,000 range with media traffic relayed using UDP.

 

Note that all calls are encrypted end-to-end, and the TURN server cannot decrypt the traffic.

[Benjaminbl12]

The fact that we need to open up all those ports is a frightening concept to be honest. Just opening UDP up fully on an enterprise/school network makes me shiver.

 

I've made a new group rule on our pfSense firewall to allow these ports and addresses and can confirm this works.