Network Access

Domain and port allowlist for connecting to Kernel

Add these destinations to your allowlist when a firewall, proxy, or sandbox restricts outbound traffic. You don’t need to open inbound ports.

Allow only the destinations used by your integration. Apply the Live View and replay rules to each viewer’s network, not just the machine running your agent.

What we commit to

The destinations and ports on this page do not change without a changelog entry and advance notice. If Kernel needs to serve traffic from somewhere new, it appears here before it reaches your account.

Within the scope of this page, the following are deliberately not covered and can change at any time:

• The specific hostname inside a wildcard, as returned in cdp_ws_url, webdriver_ws_url or browser_live_view_url. It changes between sessions.
• Which metro or host serves a given session.
• Egress IP addresses, including residential, ISP and datacenter proxy exit IPs.

Required destinations

Feature	Destinations	Port	Protocol
API, SDKs, and authenticated CLI requests	api.onkernel.com	443	HTTPS
CLI authentication (kernel login)	auth.onkernel.com, dashboard.onkernel.com	443	HTTPS
CDP, WebDriver BiDi, Live View, replays, and app connections	*.onkernel.com, *.kernel.sh	8443	HTTPS and secure WebSocket (WSS)
Live View media negotiation	stun.relay.metered.ca	80	STUN over UDP
Live View media relay	global.relay.metered.ca	443	TURN over UDP or TLS/TCP
Replay files	kernel-api-prod.s3.us-east-1.amazonaws.com	443	HTTPS

Allow both wildcard domains. Don’t copy a single hostname from a returned cdp_ws_url, webdriver_ws_url, or browser_live_view_url, because that hostname can change between sessions.

Content security policy

A network allowlist permits traffic leaving your environment. A Content Security Policy (CSP) permits content loaded by your web application. If you embed Live View or replays, configure both.

Live View

Merge these sources into your application’s existing CSP:

frame-src https://*.onkernel.com:8443
          https://*.kernel.sh:8443;
connect-src https://*.onkernel.com:8443
            wss://*.onkernel.com:8443
            https://*.kernel.sh:8443
            wss://*.kernel.sh:8443;

Replays

Merge these sources into your application’s existing frame-src directive:

frame-src https://*.onkernel.com:8443
          https://*.kernel.sh:8443
          https://kernel-api-prod.s3.us-east-1.amazonaws.com;

Troubleshooting blocked connections

• If API, SDK, or authenticated CLI requests time out, verify access to api.onkernel.com:443.
• If kernel login doesn’t complete, verify access to auth.onkernel.com:443 and dashboard.onkernel.com:443.
• If browser creation succeeds but CDP, WebDriver BiDi, or Live View won’t connect, verify access to both wildcard domains on port 8443.
• If Live View loads but remains disconnected or doesn’t show video, verify access to the STUN and TURN destinations.
• If the replay player loads but a recording doesn’t play, verify access to the replay file destination.