Video Hearings service: firewall guidance for corporate IT support services
Updated 14 November 2023
© Crown copyright 2023
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/video-hearings-service-join-from-a-corporate-network/video-hearings-service-firewall-guidance-for-corporate-it-support-services
Guidance for supporting access to the Video Hearing service from a corporate network, including our firewall rules.
The Video Hearings service is a browser-based internet service that supports real time video and audio over secure WebRTC.
Camera and microphone access
Users must be able to grant access to their device camera and microphone so that they can carry out a successful self-test of their device and participate in a video hearing.
Your browser policies must allow camera and microphone access to the following:
Real-time media
Content is served as follows:
1. Web traffic is sent via HTTPS over TCP/IP
2. Signalling to client browsers is via WSS/HTTPS
3. Video and audio traffic is sent via SRTP over TCP/IP and UDP
UDP is the preferred method of transit for real time video and audio as it gives better performance and lower latency than TCP/IP.
We recognise that in some cases, corporate firewalls cannot be opened to allow connectivity over UDP. Where WebRTC is unable to negotiate a client connection over UDP, the Video Hearings service will use HTTPS port 443 over TCP/IP for video and audio for the client.
Note that where this method of connectivity is used, the quality of a users’ video and audio will be impacted by their local network connection.
Some corporate firewalls and VPNs have packet filtering or packet inspection implemented. If this is the case, and depending on your configuration, you may need to allow media packets from the Video Hearings service if you are opting to use HTTPS port 443 for video and audio traffic.
URLs
The URLs listed below must be allowed over HTTPS port 443:
- video.hearings.reform.hmcts.net
- signalr.hearings.reform.hmcts.net
IP addresses/ranges
For the service to work, the IP addresses/ranges listed must be allowed over TCP/IP HTTPS port 443.
For the best possible user experience, the IP addresses/ranges listed should be allowed over UDP.
TCP/IP addresses
| FQDN | IP | Environment | Device |
|---|---|---|---|
| px01.hearings.hmcts.net | 35.246.61.150 | hearings - prod | Signaling node |
| px02.hearings.hmcts.net | 35.246.79.59 | hearings - prod | Signaling node |
| px03.hearings.hmcts.net | 35.246.113.194 | hearings - prod | Signaling node |
| sip.hearings.hmcts.net | 35.246.61.150 35.246.79.59 35.246.113.194 |
hearings - prod | SIP records |
| hearings.hmcts.net | 35.242.182.154 | hearings - prod | Load balancer |
| px01.self-test.hearings.hmcts.net | 35.234.138.149 | self-test - prod | Signaling node |
| px02.self-test.hearings.hmcts.net | 35.242.187.24 | self-test - prod | Signaling node |
| px03.self-test.hearings.hmcts.net | 35.197.254.119 | self-test - prod | Signaling node |
| sip.self-test.hearings.hmcts.net | 35.234.138.149 35.242.187.24 35.197.254.119 |
self-test - prod | SIP records |
| self-test.hearings.hmcts.net | 35.244.218.27 | self-test - prod | Load balancer |
| vhs-turn-prd.9kc.org | 34.105.188.62 | prod | Turn relay |
| vhs-turn-prd.9kc.org | 34.105.131.240 | prod | Turn relay |
| 35.242.182.154 35.246.61.150 35.246.79.59 35.246.113.194 35.234.138.149 35.242.187.24 35.197.254.119 35.230.139.187 35.230.135.196 35.246.107.219 35.246.20.63 35.246.124.45 35.246.61.132 35.246.26.151 35.242.138.175 35.246.14.216 35.234.149.169 35.242.154.242 35.246.67.204 35.246.103.161 35.246.64.249 35.242.129.244 35.246.107.187 |
WebRTC client networks | Load balancers and conference nodes |
UDP IP addresses/ranges
| IP address | Protocol | Port | Service | Device | |
| WebRTC client networks | 35.242.182.154 35.246.61.150 35.246.79.59 35.246.113.194 35.234.138.149 35.242.187.24 35.197.254.119 35.230.139.187 35.230.135.196 35.246.107.219 35.246.20.63 35.246.124.45 35.246.61.132 35.246.26.151 35.242.138.175 35.246.14.216 35.234.149.169 35.242.154.242 35.246.67.204 35.246.103.161 35.246.64.249 35.242.129.244 35.246.107.187 |
UDP | 40000 - 49999 | RTP Media | Load balancers and conference nodes |
|---|
Browsers
You should use the latest version of the operating system on your device.
You should also use the latest version of your internet browser. Which browser you can use depends on your device.
If you are using a laptop or desktop computer, you can use:
- Google Chrome
- Mozilla Firefox
- Microsoft Edge
- Apple Safari (on Macs only)
If you are using an Android tablet or smartphone, you can use:
- Google Chrome
- Samsung Internet
If you are using an iPad or iPhone, you can only use Apple Safari.
The Video Hearing service does not work with Internet Explorer on any device.