> ## Documentation Index
> Fetch the complete documentation index at: https://kernel.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Network Access

> Domain and port allowlist for connecting to Kernel

Add these destinations to your allowlist when a firewall, proxy, or sandbox restricts outbound traffic. You don't need to open inbound ports.

Allow only the destinations used by your integration. Apply the Live View and replay rules to each viewer's network, not just the machine running your agent.

## Required destinations

| Feature                                                      | Destinations                                  | Port   | Protocol                         |
| ------------------------------------------------------------ | --------------------------------------------- | ------ | -------------------------------- |
| API, SDKs, and authenticated CLI requests                    | `api.onkernel.com`                            | `443`  | HTTPS                            |
| CLI authentication (`kernel login`)                          | `auth.onkernel.com`, `dashboard.onkernel.com` | `443`  | HTTPS                            |
| CDP, WebDriver BiDi, Live View, replays, and app connections | `*.onkernel.com`, `*.kernel.sh`               | `8443` | HTTPS and secure WebSocket (WSS) |
| Live View media negotiation                                  | `stun.relay.metered.ca`                       | `80`   | STUN over UDP                    |
| Live View media relay                                        | `global.relay.metered.ca`                     | `443`  | TURN over UDP or TLS/TCP         |
| Replay files                                                 | `kernel-api-prod.s3.us-east-1.amazonaws.com`  | `443`  | HTTPS                            |

<Note>
  Allow both wildcard domains. Don't copy a single hostname from a returned `cdp_ws_url`, `webdriver_ws_url`, or `browser_live_view_url`, because that hostname can change between sessions.
</Note>

## Content security policy

A network allowlist permits traffic leaving your environment. A Content Security Policy (CSP) permits content loaded by your web application. If you embed Live View or replays, configure both.

### Live View

Merge these sources into your application's existing CSP:

```text theme={null}
frame-src https://*.onkernel.com:8443
          https://*.kernel.sh:8443;
connect-src https://*.onkernel.com:8443
            wss://*.onkernel.com:8443
            https://*.kernel.sh:8443
            wss://*.kernel.sh:8443;
```

### Replays

Merge these sources into your application's existing `frame-src` directive:

```text theme={null}
frame-src https://*.onkernel.com:8443
          https://*.kernel.sh:8443
          https://kernel-api-prod.s3.us-east-1.amazonaws.com;
```

## Troubleshooting blocked connections

* If API, SDK, or authenticated CLI requests time out, verify access to `api.onkernel.com:443`.
* If `kernel login` doesn't complete, verify access to `auth.onkernel.com:443` and `dashboard.onkernel.com:443`.
* If browser creation succeeds but CDP, WebDriver BiDi, or Live View won't connect, verify access to both wildcard domains on port `8443`.
* If Live View loads but remains disconnected or doesn't show video, verify access to the STUN and TURN destinations.
* If the replay player loads but a recording doesn't play, verify access to the replay file destination.