View source

{{Help|Viewer=*|BugFixes=*}}

{{RightToc|margin-left: 10px;}}
== Overview ==
This article describes how to configure your firewall to allow use of the Second Life Viewer (client) within your intranet.  It is intended for network administrators and others responsible for network security.

Firewalls are a fundamental component of a network security program. Following the "principle of least privilege," firewalls limit traffic between the corporate intranet and the public network to supported network applications.  Thus, firewalls are generally configured for common applications such as Domain Name Service (DNS), email, and web browsing.  However, Second Life uses a number of non-standard ports that most firewalls block by default.  

=== Voice chat ===
Voice chat, like Second Life itself, is designed to work with "zero configuration" and should work with most firewalls.  If the SIP connection on port 5060 fails (as it might if the router is designed to provide VoIP services of its own) the Viewer will automatically retry on port 5062. So, on some restrictive firewalls, you may need to open port 5062.

When you initially run the Second Life Viewer, your firewall may require you to permit internet access by "SLVoice.exe" and "SLVoiceAgent.exe". 

To enable people to use Second Life from inside the firewall, follow the procedures outlined in this document.

== Procedure ==

Although the details depend on your specific firewall, follow this  general procedure:

# '''Open outbound access for TCP ports'''. Second Life servers do not establish inbound TCP connections to client systems running the Second Life Viewer software. Instead, they use the "request / response" message pattern. 
#* Enable outbound TCP access for ports 80, 443, 5060, 5062, 12043 and 21002.
# '''Open outbound "session" access for UDP ports'''.  Although UDP is a session-less transport, many firewalls block unsolicited incoming UDP traffic to a particular port unless it has seen recent outgoing UDP traffic from that same port. 
#* Activate outbound UDP for ports 5060, 5062, and 12000-13050.
# '''Monitor'''. The intricacies of modern firewalls make it difficult for one document to cover every network configuration.  Use tools such as '''[http://en.wikipedia.org/wiki/Ntop ntop]''' and '''[http://www.ntop.org/nProbe.html nprobe]''' to monitor network flow between the Second Life Viewer and servers to identify network flows blocked by the firewall.

== Ports ==

In addition to the standard ports for DNS lookup and web access, the Second Life Viewer requires the ports listed in the following table.

{|border=1 cellpadding=6 style="border-collapse: collapse"
|--- style="background: #dcdcdc"
! Port
! Protocol
! Used For

|---
| 53
| UDP/TCP
| DNS lookup

|---
| 80
| TCP 
| Accessing Second Life related web resources

|---
| 443
| TCP 
| Accessing Second Life related web resources and for client authentication

|---
| 5060
| UDP and TCP 
| Voice / SIP traffic

|---
| 5062
| UDP and TCP 
| Voice / (Session Initiation Protocol) SIP traffic

|---
| 12000 - 15000
| UDP 
| Voice / RTP  traffic

|---
| 12035
| UDP 
| Core protocol communication

|---
| 12043
| UDP
| Simulator communication and map related functions

|---
| 12043
| TCP 
| Capability-based simulator communication

|---
| 13000-13050
| UDP 
| Core protocol communication

|---
| 21002
| TCP
| Voice signaling

|}

Notes:
* RTP: Real-time Transport Protocol
* SIP: Session Initiation Protocol

== Server IP Addresses ==

For up-to-date information on IP addresses, see:
* [[Linden_Lab_Official:What are Second Life's subnets|What are Second Life's subnets?]] for Second Life server IP addresses.  
* [[Can I use voice from behind a firewall|Can I use voice from behind a firewall?]] for voice server IP addresses.

You can subscribe to these articles to be notified when the article is updated. 

You may also use the Second Life Viewer to access virtual worlds hosted by organizations other than [[Linden Lab]].  Contact the hosting organization for the IP addresses used.

== Specific hardware manufacturers ==

Consult your firewall's documentation or the manufacturer's website, for instructions on how to configure your firewall. 

===Cisco===

For a Cisco router/switch that uses reflexive access lists (IOS 11.0 or later), add these lines to your outbound access list:

 permit tcp any any eq 443
 permit udp any any eq 12035 reflect outbound-SL
 permit udp any any eq 12036 reflect outbound-SL
 permit udp any any range 13000 13050 reflect outbound-SL

Then, on your inbound access list, add:

 permit tcp any any established
 evaluate outbound-SL

After adding the above lines, apply these access lists. 

===Linux Killerwall===

For a Linux system using [http://wiki.linuxquestions.org/wiki/Killerwall Killerwall], add these lines to <code>/etc/killerwall.acl</code>:

 IN IFACE <your lan interface> FROM 0.0.0.0/0 TO 0.0.0.0/0 tcp TOPORT 443 ACCEPT
 IN IFACE <your lan interface> FROM 0.0.0.0/0 TO 0.0.0.0/0 udp TOPORT 12035 ACCEPT
 IN IFACE <your lan interface> FROM 0.0.0.0/0 TO 0.0.0.0/0 udp TOPORT 12036 ACCEPT
 IN IFACE <your lan interface> FROM 0.0.0.0/0 TO 0.0.0.0/0 udp TOPORT 13000-13050 ACCEPT

Then, restart Killerwall.  Killerwall automatically tracks related reply packets, so Second Life will now work correctly.

===Linux Firewall===

For a Linux box that uses IPF (Linux Firewall), configure as follows:

 pass out quick on rl0 proto tcp from any to any port = 443 flags S keep state
 pass out quick on rl0 proto udp from any to any port = 12035
 pass out quick on rl0 proto udp from any to any port = 12036
 pass out quick on rl0 proto tcp from any to any port = 12043 flags S keep state
 pass out quick on rl0 proto udp from any to any port 12999 <> 13051
 pass in quick on rl0 proto tcp from any to any port = 443 flags S keep state
 pass in quick on rl0 proto udp from any to any port = 12035
 pass in quick on rl0 proto udp from any to any port = 12036
 pass in quick on rl0 proto udp from any to any port 12999 <> 13051

===FreeBSD IPFW===

For a firewall based on [http://en.wikipedia.org/wiki/Ipfirewall Ipfirewall (ipfw)], add the following lines to <code>/etc/rc.firewall</code>:

 ipfw add allow tcp from any to any 443 setup
 ipfw add allow udp from any to any 12035 keep-state
 ipfw add allow udp from any to any 12036 keep-state
 ipfw add allow tcp from any to any 12043 keep-state
 ipfw add allow udp from any to any 12999-13051 keep-state

== See also ==

* [[How do I configure my software firewall (such as Norton Internet Security, McAfee Personal Firewall, or ZoneAlarm)|How do I configure my software firewall?]]
* [[How do I configure my hardware firewall (such as a router)|How do I configure my hardware firewall (such as a router)?]]
* [[Unusually restrictive firewalls block teleporting|Unusually restrictive firewalls block teleporting]]