The following provides an overview of the TCP/IP networking requirements of the Startle Solution: -
Inbound Ports
There are no specific inbound ports that are required, all traffic is initiated from the inside of the network to the outside. It is “expected” that the firewall between the public Internet and the private network has a suitable intelligent firewall, performing either NAT (Network Address Translation) or PAT (Port Address Translation), that can monitor outbound requests and thus allow the return traffic to be accepted (for instance packets that have already been established outbound with SYN/TCP, and also packets that are used by connectionless protocols such as NTP).
General All destination protocols
The following provides a basic list of protocols that should be available: -
Protocol | Port | Description |
TCP/UDP | 53 | This is used to gain DNS information from the Internet. Startle also has the option of using a local internal DNS server. If opening this port is an issue please contact Startle. Startle are happy to use the Google addresses of 8.8.8.8 and 8.8.4.4 |
DHCP | 67/68 | DHCP / IP Address allocation |
TCP | 123 | This is used to retrieve the time from the Internet |
Outbound Ports
The solution uses a number of connections to these outbound ports: -
Protocol | Port | Description |
TCP | 80/443 | These ports are used for communicating with http/https servers within our solution. Destination: “Core IP”, “CDN IP” and “Host Name” |
TCP | 8999 | This port is used to establish a session with our core servers. Where opening this is an issue and for specific projects, Startle is able to advise an alternative address as required. Destination: “Core IP” and “CDN IP” |
TCP | 9000 - 9399 | This port range is used to establish a session with our core servers. Where opening this is an issue and for specific projects, Startle are able to advise a smaller range as required.(*1) Destination: “Core IP” and “CDN IP” |
TCP | 8600 - 8699 | These ports are used for websocket services to our core servers Destination: “Core IP” and “CDN IP” |
If your network allows ports 80/443 outbound, whilst restricting higher ports, we generally do not recommend using a “reserved DHCP IP address and then firewalling based on the source”. With this method if there is ever a requirement to replace the player then the firewall team would also need to make changes. Generally, a more accepted method is to restrict all internal IP addresses to these outbound ports to specific outbound hosts.
Startle Public “Core IP” Addresses
The following table provides the current list of Public IP addresses where these ports are required to: -
108.128.28.109
54.247.89.2
54.73.189.36
52.50.41.21
52.214.69.62
18.200.172.227
35.174.193.187
18.205.14.194
35.172.202.115
54.156.130.81
135.181.221.182
142.132.151.190
213.239.213.172
178.63.104.252
Startle Public “CDN IP” Addresses
In addition the following are our current CDN IP addresses (although generally these are accessed using FQDN however our system will also attempt a direct connection if the FQDN/DNS fails): -
151.101.2.217 (core CDN)
151.101.66.217 (core CDN)
151.101.130.217 (core CDN)
151.101.194.217 (core CDN)
65.109.29.178 (edge CDN)
65.21.223.164 (edge CDN)
168.119.33.115 (edge CDN)
78.46.82.70 (edge CDN)
NOTE: The IP addresses above are the addresses that require all of the listed ports (Outbound Ports). The music player will also require connectivity to a number of other sites through “standard” ports such as 80/443 (access to specific music libraries) listed under Outbound Hostnames.
Public “Host Name” via FQDN
On rare occasions there is a customer specific requirement to also limit to specific domains. The following provides a list of domains that may currently be accessed outbound from your site: -
*.startleint.com
*.startlemusic.com
*.startlegroup.com
*.startle.studio
*.str.tl
*.mybigiq.com, specifically: -
config2.mybigiq.com
config.mybigiq.com
bucket.mybigiq.com
*.amazonaws.com, specifically: -
mbibucket1.s3.amazonaws.com
mbilb1-1419337587.eu-west-1.elb.amazonaws.com
vjukebox-messaginguploads.s3.amazonaws.com
*.s3-eu-west-1.amazonaws.com (sent by UI to edge)
*.auth0.com
*.workos.com
N.B.: user/app access to the Startle Dashboard will be resolved through the above domain names however their public addresses may be dynamic.
N.B.: It is recommended that you add the wildcard versions to allow any change to subdomains in the future
(i.e. add *.amazonaws.com rather than mbibucket1.s3.amazonaws.com)
Proxy Based Solutions
NOTE: most network setups do not use proxy services within the architecture.
If you do not use proxy servers please skip this section.
The Startle media player requires 2 specific forms of communication those being
Control and management TCP, always connected very low bandwidth
Media download (music, signage etc), outbound web based download of data, bandwidth requirements vary depending on size of files to be acquired and how frequent.
For part 1 above it is possible and proven that this could run through an outbound NAT solution where the Startle media player assumes communication with a private address within the customer’s addresses space and then NAT’d to Startle’s public address space above.
For part 2 it is possible as part of the configuration for the Startle media player to talk through a configured proxy solution within the customers network environment for access to these web based media content.
Please speak directly to Startle for specific requirements on connectivity options.
IMPORTANT NOTES
NOTE (*1) - in the table above there are “potentially” large groups of ranges however we are able to reduce this considerably and still offer great support. Please speak to your Startle account team to arrange a more in depth discussion as needed. Generally a reduction is not required with specific end point IP addresses.
NOTE: It is important that the outbound traffic has the ability to communicate outbound with the above ports and that no Login/“Capture Portals” are deployed prohibiting this.
NOTE: Startle is a very dynamic organisation and welcomes conversations on any of the above where this cannot be accommodated within the existing security policy as Startle’s solution is very flexible. Startle is ISO27001 accredited.
Every care has been taken in the compilation of this information and we cannot be held responsible for any errors or omissions.