Skip to main content

Firewall configuration

Seqera Platform Cloud (cloud.seqera.io) connects to resources in your network, such as your storage server, container registry, or Git server. Your compute environments and your users connect to Seqera services. Configure your firewall to allow the traffic in each direction.

IP addresses​

Seqera keeps a current list of its IP addresses at meta.seqera.io. Parse its JSON response to update your firewall rules. For example, in Python with the requests package:

$ python3
>>> import requests
>>> requests.get("https://meta.seqera.io").json()
{
  "egress": ["a.b.c.d/32", "..."],
  "ingress": ["e.f.g.h/32", "..."]
}

The response contains two lists. The list you need depends on the direction of the traffic:

To allowUseThe list contains
Seqera to reach a resource in your network, such as your storage server, container registry, or Git serveregressThe addresses Seqera connects from
Your compute environments or your network to reach a Seqera service, such as wave.seqera.ioingressThe addresses Seqera services are reachable at

You only need the ingress list if your outbound rules are IP-based rather than DNS-based. For DNS-based rules, see DNS allowlist.

note

Always query meta.seqera.io when you build or review your firewall rules. A copied list becomes stale as we may add or remove IPs when needed.

Wave​

Wave traffic runs in both directions, and each direction uses a different list:

  • To let Wave read from or write into your container registry, allow the egress addresses in your registry's network rules. Wave connects to your registry from Seqera's network in every mode, including augment, mirror, and freeze.
  • To let your compute environments call Wave, allow the ingress addresses in your outbound rules if those rules are IP-based.

Wave cannot reach a registry that is exposed only through a private endpoint inside your network, and allowlisting does not change this.

Studios​

A Studio session needs no inbound connections. The Connect client in each session opens an outbound tunnel to the Connect server, and users reach the session through the Connect proxy. Allow the following connections:

FromToPortUsed for
Your users' browsersconnect.cloud.seqera.io and *.connect.cloud.seqera.io443Opening Studio sessions over HTTPS and secure WebSocket (WSS)
Studio sessions in your compute environmentsconnect.cloud.seqera.io and *.connect.cloud.seqera.io443The Connect client's WSS tunnel, which carries all session traffic, including SSH
Studio sessions in your compute environmentsThe Seqera Platform domains in the DNS allowlist443Session status notifications and authentication
Your users' SSH clientsThe Connect domain in your SSH connection string2222SSH connections to Studio sessions (public preview). See Connect to a Studio via SSH.

The browser and SSH rows apply to your users' own networks, not only to your compute environments. If a corporate firewall or web proxy blocks WebSocket traffic to connect.cloud.seqera.io or its subdomains, sessions reach running status but the browser can't display them. See Session is running but the interface is blank.

DNS allowlist​

To access resources such as Fusion tarballs, nf-xpack files, Wave containers, and other Seqera services, add *.seqera.io.cdn.cloudflare.net to the allowlist in your network firewall. If your firewall doesn't support DNS wildcards, add the following:

  • cloud.seqera.io
  • api.cloud.seqera.io
  • user-data.cloud.seqera.io
  • tower.nf
  • api.tower.nf
  • connect.cloud.seqera.io and its subdomains *.connect.cloud.seqera.io
  • hub.seqera.io
  • ai.seqera.io
  • ai-api.seqera.io
  • wave.seqera.io
  • community.wave.seqera.io
  • cerbero.seqera.io
  • public.cr.seqera.io
  • auth.cr.seqera.io
  • cr.seqera.io
  • licenses.seqera.io
  • api.multiqc.info
  • fusionfs.seqera.io
  • nf-xpack.seqera.io
  • community-cr-prod.seqera.io
  • public-cr-prod.seqera.io
  • wave-cache-prod-cloudflare.seqera.io
  • fusionfs.seqera.io.cdn.cloudflare.net
  • nf-xpack.seqera.io.cdn.cloudflare.net
  • community-cr-prod.seqera.io.cdn.cloudflare.net
  • public-cr-prod.seqera.io.cdn.cloudflare.net
  • wave-cache-prod-cloudflare.seqera.io.cdn.cloudflare.net
  • registry.nextflow.io (required from Nextflow 25.10)
note

Nextflow calls registry.nextflow.io to resolve and download plugins. It also calls the registry when plugins are cached locally, to check for updates and resolve plugin metadata. If your firewall blocks this domain, runs fail.

If you allowlist individual DNS records, review this list when you update your rules, because Seqera adds services over time.

note

If your allowlist is based on IP addresses, allow all of the Cloudflare IP addresses.

On this Page