Ports and protocols
Confirm before relying.
Option 1 is a domain allow list: the instance on TCP 443, telemetry, transport, and TurnNlb on UDP 3478. Option 2 is the AWS IP ranges and is documented as not recommended. Test more than 200 calls. An error rate above 2 percent points at proxy or DNS resolution.
Media should not hairpin through a VPN. Stateless firewalls also need the browser's ephemeral UDP range, because there is no lasting 'pin' the way people imagine.
- The usual failure string names turn:TurnNlb and port 3478.
- ice_collection_timeout means the browser never gathered candidates.
- A custom CCP can be media-less, but then you still do not have a softphone.
- Video adds a Chime subnet and does not support VDI.
Source: Set up your network to use the Connect Customer Contact Control Panel (CCP) - Amazon Connect Customer AWS docs. last checked 2026-10
Sources and go deeper
- Set up your network to use the Connect Customer Contact Control Panel (CCP) - Amazon Connect Customer AWS docs. last checked 2026-10
- How Contact Control Panel (CCP) uses WebRTC - Amazon Connect Customer AWS docs. last checked 2026-10
- RFC 5766: Traversal Using Relays around NAT (TURN): Relay Extensions to Session Traversal Utilities for NAT (STUN) | RFC Editor RFC. last checked 2026-10
- RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3 | RFC Editor RFC. last checked 2026-10
- RFC 8825: Overview: Real-Time Protocols for Browser-Based Applications | RFC Editor RFC. last checked 2026-10
- WebRTC - Wikipedia Wikipedia. last checked 2026-10
- Transport Layer Security - Wikipedia Wikipedia. last checked 2026-10