Allowlist for outbound connections to Twingate infrastructure
Last updated: June 15, 2026
Upcoming change: Starting July 10, 2026, we're making changes to our underlying networking infrastructure. If you're currently restricting outbound connections to Twingate infrastructure, you'll need to add the Twingate-owned IP block 167.254.176.0/21 to your allowlist alongside existing GCP IP ranges.
Applicable to:
Twingate Component: Client | Connector
Overview
Twingate Client and Connectors requires outbound connectivity on the following ports–
Reference: Endpoint Requirements - Firewall Rules
Outbound initiated TCP
*:443(basic communication with the Twingate Controller and Relay infrastructure)Outbound initiated TCP
*:[30000-31000](opening connections with Twingate Relay infrastructure in case peer-to-peer is unavailable)Note– Relay connections will be set directly to an ephemeral IP within the Google Cloud's IP ranges for Relay Cluster Locations
Google's maintained list of IP ranges– Global and regional external IP address ranges for customers' Google Cloud resources
Outbound initiated UDP
*:*(allows for peer-to-peer connectivity for optimal performance)
FQDN allowlist
Some users might wish to have stricter limits with outbound connectivity from their environments. If possible, a wild card could be used and *.twingate.com would suffice. If wildcards are not possible, the FQDNs below can be used. Please keep in mind that this list is subject to change at any time.
subdomain.twingate.com <--- This is your network name and should be changed to match.admin.twingate.com
analytics.twingate.com
api.twingate.com
binaries.twingate.com
dns.twingate.com
docs.twingate.com
get.twingate.com
h2.pubnubapi.com
help.twingate.com
oauth.twingate.com
pubsub.pubnub.com
ps.pndsn.com
relays.twingate.com
relays-prm.twingate.com
saml.twingate.com
sst-preview-server.twingate.com
sst.twingate.com
stape.twingate.com
stun-alt.asia-northeast1-a.twingate.com
stun-alt.asia-south1-a.twingate.com
stun-alt.asia-southeast1-a.twingate.com
stun-alt.australia-southeast1-a.twingate.com
stun-alt.europe-north1-a.twingate.com
stun-alt.europe-west2-a.twingate.com
stun-alt.europe-west3-a.twingate.com
stun-alt.europe-west6-a.twingate.com
stun-alt.me-west1-a.twingate.com
stun-alt.southamerica-east1-a.twingate.com
stun-alt.us-central1-a.twingate.com
stun-alt.us-east1-d.twingate.com
stun-alt.us-east4-a.twingate.com
stun-alt.us-east4-b.twingate.com
stun-alt.us-east5-a.twingate.com
stun-alt.us-west1-a.twingate.com
stun-alt.us-west2-a.twingate.com
stun.asia-northeast1-a.twingate.com
stun.asia-south1-a.twingate.com
stun.asia-southeast1-a.twingate.com
stun.australia-southeast1-a.twingate.com
stun.europe-north1-a.twingate.com
stun.europe-west2-a.twingate.com
stun.europe-west3-a.twingate.com
stun.europe-west6-a.twingate.com
stun.me-west1-a.twingate.com
stun.southamerica-east1-a.twingate.com
stun.us-central1-a.twingate.com
stun.us-east1-d.twingate.com
stun.us-east4-a.twingate.com
stun.us-east4-b.twingate.com
stun.us-east5-a.twingate.com
stun.us-west1-a.twingate.com
stun.us-west2-a.twingate.com
support.twingate.com
twingate.com
url6332.twingate.com