Configure a Palo Alto Firewall

This guide explains how to configure a Palo Alto firewall to allow Reemo to use an optimal connection (direct/udp) and avoid unnecessary fallback to relays.
A correct configuration reduces latency and improves the audio/video quality of sessions.
Without this configuration, Reemo can still work, but connections will fall back to relays (relay/tcp, relay/udp, websocket) with reduced performance.
Before starting, make sure your Palo Alto firewall (PA Series, PAN-OS) is properly installed and accessible via its web administration interface.
Then log in to the interface with your administrator credentials.

Note

This configuration is provided as an example.
Screens and labels may vary slightly depending on your PAN-OS version.
The proposed names for objects (reemo-cloud, reemo-signaling, etc.) are indicative: you may use your own naming conventions.

Step 1: Add the Reemo addresses

In Objects > Addresses, add the following addresses (Type: FQDN):

  • reemo-download: download.reemo.io

  • reemo-signal: signal.reemo.io

  • reemo-turn-cloudflare: turn.cloudflare.com

  • reemo-turn1: turn1.reemo.io

  • reemo-turn2: turn2.reemo.io

List of Reemo addresses in Palo Alto

Reemo addresses configured in Objects > Addresses.

Then group them in Objects > Address Groups:

  • reemo-cloud: groups the 5 addresses above.

reemo-cloud address group

reemo-cloud address group, grouping the 5 Reemo addresses.

Step 2: Add the required services

In Objects > Services, add:

  • reemo-turn-tcp-3478: Protocol TCP, Destination Port 3478

  • reemo-turn-udp-3478: Protocol UDP, Destination Port 3478

  • reemo-turn-udp-443: Protocol UDP, Destination Port 443

  • reemo-media-udp: Protocol UDP, Destination Port 1024-65535, Source Port 58200-58400

List of Reemo services in Palo Alto

Reemo services configured in Objects > Services.

Detail of the reemo-media-udp service

Detail of the reemo-media-udp service (WebRTC port range).

Note

The wide range (1024-65535) is required by WebRTC to establish peer-to-peer connections. Traffic remains end-to-end encrypted and restricted to Reemo communications.

Group the signaling services in Objects > Service Groups:

  • reemo-signaling: groups reemo-turn-tcp-3478, reemo-turn-udp-3478, reemo-turn-udp-443 and the predefined service-https service.

reemo-signaling service group

reemo-signaling service group.

Step 3: Create the security rules

In Policies > Security, add these two rules:

  • Reemo-Signaling-TURN:

    • Source Zone: trust

    • Destination Zone: untrust

    • Destination Address: reemo-cloud

    • Service: reemo-signaling

    • Action: Allow

  • Reemo-Media-P2P:

    • Source Zone: trust

    • Destination Zone: untrust

    • Destination Address: any

    • Service: reemo-media-udp

    • Action: Allow

Note

The Reemo-Media-P2P rule targets any as the destination: the peer-to-peer WebRTC connection can reach a browser located anywhere on the internet, not just the Reemo infrastructure.

Overview of the Reemo security rules

Overview of the configured security rules.

Step 4: Configure NAT

In Policies > NAT, add a source NAT rule for outgoing traffic:

  • LAN-Source-NAT:

    • Source Zone: trust

    • Destination Zone: untrust

    • Source Address: your internal subnet (e.g. 192.168.50.0/24, adjust as needed)

    • Translated Packet > Source Translation: see below (depends on your PAN-OS version)

Overview of the Reemo NAT rule

Overview of the configured NAT rule on PAN-OS earlier than 11.1.

Note

For WebRTC sessions to remain stable behind this dynamic translation, the firewall must keep the same IP/port mapping for a given source (Persistent DIPP). Which translation type to select depends on your PAN-OS version:

  • PAN-OS earlier than 11.1: select Dynamic IP and Port, then enable the persistent behavior globally on the firewall, in Device > Setup > Session (Session Settings), or via CLI: set system setting persistent-dipp enable yes.

  • PAN-OS 11.1 and later: select Persistent Dynamic IP and Port directly as the translation type — no additional global setting is needed.

Warning

In both cases, restarting the firewall is mandatory for the change to take effect.

Summary: Ports and addresses to open

For quick reference, here is a summary table of the required flows for Reemo to work properly in direct/udp mode:

Usage

Protocol

Ports

Destination

Signal server

TCP

443

signal.reemo.io

TURN servers

TCP/UDP

3478, UDP 443

turn.cloudflare.com, turn1.reemo.io, turn2.reemo.io

Download server

TCP

443

download.reemo.io

Reemo Media (P2P)

UDP

1024–65535 (src 58200–58400)

any (peer-to-peer connection)