Firewall matrix

Same ports as the ports sheet, laid out as a change ticket. The video row is unverified on purpose.

hop	proto	port	direction	dest	note
CCP and admin signaling	TCP	443	Outbound	The instance domain (*.my.connect.aws) and the other domains on the documented allow list	Option 1 in the network guide is a domain allow list. Option 2, the AWS IP ranges, is documented as not recommended.
Softphone media	UDP	3478	Outbound	TurnNlb-*.elb.<region>.amazonaws.com in the instance Region	The usual failure string names turn:TurnNlb and port 3478. Media should not hairpin through a VPN.
Return media on a stateless firewall	UDP	Browser ephemeral range	Back to the browser	The agent workstation	There is no lasting pin. A stateless firewall has to allow the browser's ephemeral UDP range. The exact range depends on the OS, so this row does not invent a number.
ICE failure symptom	UDP and DNS	3478	Outbound	The same TURN name, resolved from the agent PC	ice_collection_timeout means the browser never gathered candidates. Resolve TurnNlb from that PC, not from a jump host.
Allow-list proof	TCP and UDP	443 and 3478	Outbound	The domains in the allow list	Test more than 200 calls. An error rate above 2 percent points at proxy or DNS resolution.
Video	Chime media	Not copied here	Outbound	An Amazon Chime subnet, in addition to the softphone path	UNVERIFIED as a port list. The network lesson says video adds a Chime subnet and does not support VDI. Confirm the current port table on the video page before you ticket a firewall change.

Sources and go deeper