Skip to main content
Quarterzip calls run in the browser over WebRTC, using Daily for call media. Most networks work without changes. If callers on your network see “We couldn’t access your audio devices”, “Your network blocked the audio” or “The connection failed”, your firewall or proxy is blocking part of the call. This page is for the IT team that manages that network.

​
Choose a configuration

There are two supported configurations. Pick one, and apply it completely.
Do not partially allow UDP. This is the most common cause of failed calls.If a firewall lets connection checks through but drops the encrypted media that follows, the browser sees UDP working, picks it, and no audio ever arrives. Either allow UDP to the call servers fully (Recommended) or block it fully (Minimal).

​
Step 1: Allow the required hosts

These rules are needed for both configurations.

​
Web and call setup (TCP 443)

dailywebrtc.com and dailywebrtc.net are Daily’s fallback domains. A wildcard on daily.co does not cover them, so allow them alongside it.
If your firewall cannot use wildcard hostnames, or applies hostname rules poorly to UDP, allowlist by IP using Daily’s published IP list (the sfu and web hosts). The list changes over time, so poll it on a schedule. See Daily’s Networking Guide for details.

​
STUN connection checks

​
Step 2: Apply one configuration

The smallest set that connects a call on almost any network. All call media is relayed over TLS on port 443, which looks like ordinary HTTPS to most firewalls.1. Allow the TLS relay hosts over TCP/TLS 443, in addition to the required hosts:
  • turn.cloudflare.com
  • *.turn.twilio.com
2. Block outbound UDP for call traffic completely:Calls then go straight to the TLS relay instead of trying a UDP path that will not carry media. STUN over UDP stays allowed.What you give up: relayed TCP adds latency and copes badly with packet loss. One-to-one voice calls are usually fine; quality drops on lossy networks.

​
Step 3: Check TLS inspection and VPNs

  • Let Daily’s call resources load unchanged. Each call starts by downloading a JavaScript file from c.daily.co (or c.dailywebrtc.com / c.dailywebrtc.net). Content filters, file-type rules or sandboxing that block, delay or replace JavaScript from these hosts stop the call before it connects.
  • Do not inspect call traffic. Exclude STUN, TURN and the call servers above from any decrypt-and-re-encrypt or deep packet inspection rule. Call media is already encrypted end to end, so inspection has nothing to read, and it breaks the connection.
  • Use split tunnelling for VPNs and secure web gateways (for example Zscaler) so call traffic bypasses the tunnel.
  • Route call traffic the same way on every operating system. Some clients tunnel TCP but send UDP directly out of the local network. This recreates the partial-UDP problem above on some machines only.

​
Still not working?

  1. Run Quarterzip’s network test from an affected machine to see which connections fail.
  2. Email support@quarterzip.ai with the results and the time of the failed call.