Network configuration requirements

    Endpoints, protocols, and IP addresses that must be reachable from your network to use Commbox. Use this reference when configuring corporate firewalls, web proxies, or zero-trust egress policies.

Overview

• All Commbox endpoints use HTTPS over TCP/443 unless explicitly noted.
• Real-time features additionally use WebSocket Secure (wss://) over TCP/443.
• Long-lived (persistent) outbound connections must not be terminated by intermediate proxies.
• Allowlist by domain wherever possible. Commbox runs on AWS behind Cloudflare and AWS load balancers; backing IP addresses change without notice. Domain-based rules are stable; IP-based rules will eventually break.

Required for all customers

These endpoints must be reachable for the platform to load and function.

Core platform

Static assets and UI

Login security

Required per module or channel

The following endpoints are only required if you use the corresponding feature. Skip the rows for channels you do not use.

Facebook Messenger, WhatsApp, Instagram

Google services (Drive, Calendar, My Business, Maps, Play reviews)

Microsoft 365 (Outlook, Exchange Online)

Amazon Connect (SAML SSO)

Recommended

Not strictly required, but disabling these reduces our ability to monitor performance, diagnose issues, and provide product analytics.

Optional convenience features

IP-based allowlisting Fallback only

Outbound from your network to Commbox

If your firewall does not support FQDN rules, allow outbound HTTPS (TCP/443) to the following Commbox application IPs:

54.76.101.23
52.212.81.15

52.51.230.223

52.51.55.64

34.253.33.63

52.48.122.222

54.171.16.182

54.246.232.150

54.229.199.80

54.77.77.35

54.77.112.4

34.249.133.125

Outbound from your network to Commbox SMTP

Only required if you use Commbox-hosted email channels. Allow outbound TCP/443 to:

34.249.57.65
52.215.60.193

Inbound to your network from Commbox

If your environment receives webhooks, HTTP callbacks, or other initiated traffic from Commbox (for example, to a customer-hosted webhook receiver), allow the following source IPs:

46.137.14.237
34.253.247.49

213.57.31.162

For sandbox or pre-production testing only:

63.33.139.133

Long-lived connection support

The Commbox inbox uses persistent WebSocket connections to deliver real-time updates. Confirm with your network team that:

• Idle TCP timeouts on egress proxies allow connections to remain open for at least 60 minutes.
• WebSocket upgrade headers (Connection: Upgrade, Upgrade: websocket) are not stripped by HTTP-inspecting proxies.
• If TLS interception is in use, the proxy must present a certificate trusted by client browsers for *.commbox.io.

Validation checklist

After applying allowlist rules, verify the following from a workstation behind the firewall:

1. The Commbox web app loads completely with no missing fonts or blank UI tiles.
2. Login completes successfully (validates reCAPTCHA and authentication paths).
3. New messages appear in the inbox without a manual refresh (validates WebSocket connectivity).
4. For each channel in use, send and receive a test message end-to-end.
5. Run the following commands and confirm both succeed:

curl -v https://api.commbox.io
curl -v https://now.commbox.io

Support

If connectivity issues persist after applying these rules, contact Commbox support with:

• The exact error message or HTTP status code observed.
• Output from curl -v against the affected endpoint.
• Browser developer console logs from a failed session.
• The list of allowed domains and IPs currently configured in your firewall.