Sender machine

The sender machine needs outbound access to the following hosts on port 443 (HTTPS):

HostPurpose
*.devtunnels.msDev Tunnel relay — all tunnel traffic
global.rel.tunnels.api.visualstudio.comDev Tunnels management API
login.microsoftonline.comMicrosoft OAuth (Microsoft account login)
login.live.comMicrosoft personal account login
github.comGitHub OAuth (GitHub account login)
aka.msMicrosoft shortlinks (DevTunnel CLI installer redirect)
cdn.jsdelivr.netBootstrap 5, Bootstrap Icons, Alpine.js (sender web UI CDN)

ℹ️ Info: *.devtunnels.ms is a wildcard — the tunnel URL is a unique subdomain generated per session (e.g. abc123.devtunnels.ms). Your firewall rule must allow all subdomains.

Receiver machine

The receiver machine needs outbound access to:

HostPurpose
*.devtunnels.msDev Tunnel relay — all requests to the sender are proxied through here
cdn.jsdelivr.netBootstrap 5, Bootstrap Icons, Alpine.js (receiver web UI CDN)

ℹ️ Info: The receiver does not need DevTunnels CLI installed, nor does it need to authenticate with Microsoft or GitHub. It only needs to reach the tunnel URL and load CDN assets.

Installation only

These hosts are only needed during tool installation (or DevTunnels CLI auto-install) and are not required at runtime:

HostPurpose
api.nuget.orgDownload Garrard.CloudShare.Sender and Garrard.CloudShare.Receiver packages
aka.msRedirect for DevTunnels CLI installer script
github.comDevTunnels CLI GitHub releases download
objects.githubusercontent.comDevTunnels CLI binary download (GitHub CDN)

CDN resources (exact URLs)

The following CDN resources are loaded by both UIs at runtime. If you need to allowlist specific paths rather than the full domain:

ResourceURL
Bootstrap 5.3.3 CSShttps://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css
Bootstrap 5.3.3 JShttps://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js
Bootstrap Icons 1.11.3https://cdn.jsdelivr.net/npm/bootstrap-icons@1.11.3/font/bootstrap-icons.min.css
Alpine.js 3.x.xhttps://cdn.jsdelivr.net/npm/alpinejs@3.x.x/dist/cdn.min.js

All resources are loaded from cdn.jsdelivr.net over HTTPS.

Port summary

PortProtocolDirectionRequired by
443HTTPS/TLSOutboundBoth sender and receiver (all Dev Tunnel + CDN traffic)
5000HTTPLocalhost onlySender web UI (default, configurable with --port)
5001HTTPLocalhost onlyReceiver web UI (default, configurable with --port)

No inbound ports need to be opened on either machine. Both tools only listen on localhost for the browser UI. All external connectivity is outbound-only through Dev Tunnels.

Air-gapped or restricted environments

If either machine cannot reach the CDN (cdn.jsdelivr.net), the web UI will load but will appear unstyled (no Bootstrap CSS or icons). The core functionality (sharing, receiving, hash verification) is unaffected — it is purely a visual degradation.

If the sender machine cannot reach *.devtunnels.ms or global.rel.tunnels.api.visualstudio.com, the tunnel cannot be created and the tool will not start. This is a hard requirement for the sender.

If the receiver machine cannot reach *.devtunnels.ms, it cannot connect to the sender and the tool will fail to start.

Checklist for restricted environments

  • Sender outbound: *.devtunnels.ms:443 ✅ required
  • Sender outbound: global.rel.tunnels.api.visualstudio.com:443 ✅ required
  • Sender outbound: login.microsoftonline.com:443 or github.com:443 ✅ required (auth)
  • Sender outbound: cdn.jsdelivr.net:443 ⚠️ optional (UI styling only)
  • Receiver outbound: *.devtunnels.ms:443 ✅ required
  • Receiver outbound: cdn.jsdelivr.net:443 ⚠️ optional (UI styling only)