The short version
Most networks need no changes: everything starts on the web's usual port, 443. If you manage a firewall, allow the connections below. The browser and the host only ever connect out, except for the LAN direct port, which people on your own network connect in to.
For the browser
HTTPS to alluno.io.
A secure WebSocket to *.alluno.io. It finds the machine and sets up the session.
WebTransport to the relay the session is given. Some relays are not under alluno.io, so if your firewall filters by name, allow UDP 443 out to any address.
Where UDP is blocked, or the browser has no WebTransport, the stream falls back to a WebSocket through the same relay. It works, with more delay.
Peer to peer where the network allows it, on ports the two ends agree on. Otherwise through a relay: STUN on UDP 443 and 3478, TURN on UDP and TCP 443 and TLS 5349, then UDP 49152 to 65535 for the relayed media.
Voice and video in a session, and live rooms. Behind a strict firewall they fall back to TURN on UDP 3478 and TLS 5349.
For the machine you share
HTTPS and a secure WebSocket to *.alluno.io.
The same relays as the browser, for Media over QUIC, and the same STUN and TURN for WebRTC.
People on the same network connect straight to the machine on this port, set by LAN direct port in the app. Allow it in on your local network. On Windows, the background service adds this rule when you install it. Run without the service, Windows may ask the first time.
To reach the machine directly from outside your network, forward the LAN direct port on your router and fill in Public IP in the app. Everyone else goes through the relay. See Network and control.
When a session does not start
- Open the stream page's statistics. A delay that never appears usually means UDP is blocked: allow UDP 443 and 4443 out, or let the fallback take over.
- If the picture comes but stalls on a busy network, try the other transport in the machine's settings.
- On a company network, ask for the ports above. The connections are all outgoing except LAN direct, and every hop is encrypted.