Configuring A Firewall For Box Applications and Services – Box Support

UPDATE: This is a new format/layout of the Box Firewall page. You can still visit the existing firewall page (we will copy this new version on to the existing page in a few weeks).

A firewall is a part of network security that controls which network traffic can enter or leave your business. Firewalls can be set to block all traffic, allow or block specific types, or permit all traffic. In most cases, a firewall is set up to allow traffic through specific ports unless explicitly blocked, or for more stringent security measures, to block traffic unless explicitly allowed.

Firewalls are configured to allow or block traffic in several ways, including by geographic source, by port, by domain/hostname, and by IP address. Box and Box applications require the traffic to and from specifically defined domains to be allowed through a corporate or personal firewall, as outlined in this topic.

Typically, you would include these domains/hostnames in your firewall's allowlist. Please refer to the instructions for your particular firewall hardware or software for details.

1. Firewall Allowlist Domains/Hostnames

Here are the domains/hostnames that need to be allowlisted for Box and its applications, integrations, and components to work correctly. Box will notify you of any changes in this list through product announcements. Box recommends regularly checking this page to stay updated, or ”following” the section that contains this page, It is important to update your firewall whenever there are any changes.

Configure firewall allowlist with any subdomain and Hosts of Box Core domains and any other related services.

1a. Box Core Domains

Best practice is to use our site's domain names instead of a particular site IP address. IP addresses can change frequently and without notice.

Configure hostnames to recognize any subdomain of:

 *.box.com
 *.app.box.com
 *.ent.box.com   # "ent" only required if you are a Box Verified Enterprise account
 *.box.net
 *.boxcdn.net
 *.boxcloud.com

1b. Other related service Domains/Hosts

# Box Test
*.box-test.com

# Excel online previewer
*.cdn.office.net
excel.officeapps.live.com
fs.microsoft.com

# Box for Microsoft Teams
unpkg.com
cdn.jsdelivr.net

# Box Sign
fonts.gstatic.com
fonts.googleapis.com

# Box Support Site and Product Documentation
box.zendesk.com

# Box Education
*.brightcove.com
*.brightcove.services
*.zencdn.net
*.boltdns.net
*.akamaihd.net

# Box Web Analytics
cdn.amplitude.com
*.demdex.net

Other integrations:

Box for Office Integration: To use the Box for Office Online integration, please allow Microsoft's for Office 365 URLs and IP address ranges.
Box for Google Workspace: To use the Box for Google Workspace, please go to the Google support pages for the hostnames you must allow. (You can ignore the Google Drive/drive IP addresses because this Box integration does not have a dependency on Google Drive.)
Box for iWork Integration: To use the Box for iWork integration, you must allow access to Apple’s network at 17.0.0.0/8

Important: If above Domains / Host names are not allowed, related functions or services won’t work. Use the section below:

1c. Specific hostnames

If you cannot allow the wildcard domains shown in the two lists above, allow these specific hostnames:

# Box core features
2.realtime.services.box.net
account.box.com
api.box.com
app.box.com
ent.box.com
blog.box.com
box-test.com
captcha.boxcdn.net
cdn01.boxcdn.net - cdn20.boxcdn.net
client-log.box.com
community.box.com
developer.box.com
dl.boxcloud.com
dl2.boxcloud.com - dl20.boxcloud.com
public.boxcloud.com
docs.box.com
e3.boxcdn.net
images-captcha.boxcdn.net
newassets-captcha.boxcdn.net
notes.services.box.com
reportapi-captcha.boxcdn.net
rtg.services.box.com
sso.services.box.net
status.box.com
support.box.com
track.box.com
upload.app.box.com
upload.ent.box.com
upload.box.com
upload.box.net
www.box.com
www.box.net
{yourcustomsubdomain}.account.box.com
{yourcustomsubdomain}.app.box.com
{yourcustomsubdomain}.box.com
{yourcustomsubdomain}.ent.box.com

# Excel online previewer
res-1.cdn.office.net
omex.cdn.office.net
excel.officeapps.live.com
fs.microsoft.com

# Box for Microsoft Teams
unpkg.com
cdn.jsdelivr.net

# Captcha
captcha.boxcdn.net
newassets-captcha.boxcdn.net

# Box Sign
fonts.gstatic.com
fonts.googleapis.com

# Box Support Site and Product Documentation
box.zendesk.com
support.box.com

# Box Education
edge.api.brightcove.com
gallery.assets.brightcove.com
interactivity-collector.metric.brightcove.com
interactivity.viewer.api.brightcove.com
metrics.brightcove.com
player.interactivity.brightcove.com
players.brightcove.net
cdn.vee.brightcove.services
reflector.brightcove.services
resources.interactivity.brightcove.com
simulive-license-service.brightcove.services
vjs.zencdn.net
cf-images.us-east-1.prod.boltdns.net
cbolt446c5271-a.akamaihd.net

# Box Web Analytics
cdn.amplitude.com
sanalytics.box.com
box.demdex.net
dpm.demdex.net
pendo-data-prod.box.com
pendo-prod.box.com

# Box Zones
fupload-usw1.app.box.com
fupload-usw1.ent.box.com
usw1.boxcloud.com

fupload-nane1.app.box.com
fupload-nane1.ent.box.com
nane1.boxcloud.com

fupload-euw2.app.box.com
fupload-euw2.ent.box.com
euw2.boxcloud.com

fupload-euc1.app.box.com
fupload-euc1.ent.box.com
euc1.boxcloud.com

fupload-ane1.app.box.com
fupload-ane1.ent.box.com
ane1.boxcloud.com

fupload-ause1.app.box.com
fupload-ause1.ent.box.com
ause1.boxcloud.com

fupload-sae1.app.box.com
fupload-sae1.ent.box.com
sae1.boxcloud.com

fupload-ase.app.box.com
fupload-ase.ent.box.com
ase.boxcloud.com

fupload-euw9.app.box.com
fupload-euw9.ent.box.com
euw9.boxcloud.com

fupload-euw1.app.box.com
fupload-euw1.ent.box.com
euw1.boxcloud.com

fupload-as1.app.box.com
fupload-as1.ent.box.com
as1.boxcloud.com

Other integrations

Box for Office Integration: To use the Box for Office Online integration, please allow Microsoft's for Office 365 URLs and IP address ranges.
Box for Google Workspace: To use the Box for Google Workspace, please go to the Google support pages for the hostnames you must allow. (You can ignore the Google Drive/drive IP addresses because this Box integration does not have a dependency on Google Drive.)
Box for iWork Integration: To use the Box for iWork integration, you must allow access to Apple’s network at 17.0.0.0/8

Important: If above Domains / Host names are not allowed related functions or services won’t work.

2. Port and connection details:

Enable HTTPS port 443 TCP for the domains above, and allow Web Socket protocol wss://.
To connect with HTTP/3 (QUIC), Box recommends you also optionally enable port 443 UDP.

Update: Box is integrating ZSTD (Zstandard) compression (rfc8878) to improve performance and reduce bandwidth usage when supported by the client's browser (see Product Announcement). ZSTD is a lossless data compression technique that accelerates page loading from Box. By default, the browsers Chrome, Edge, Firefox, and Opera enable ZSTD compression. It is important to be aware that ZSTD previously encountered compatibility issues with FortiGate and Zscaler but are now resolved. Although unlikely, other firewalls that perform deep packet inspection (DPI) may encounter issues with Box's ZSTD implementation. To ensure optimal functionality, we recommend that network administrators either upgrade their firewall/proxy systems to versions that support ZSTD compression, or to disable HTTPS packet inspection in your firewall/proxy for the domains *.box.com and *.boxcloud.com . Making these changes will help maintain the integrity and efficiency of data transfers.

Alternatively, ZSTD Content-Encoding support can be disabled directly in a browser but this may lead to decreased performance on all sites using ZSTD:

Chrome: Visit chrome://flags/#enable-zstd-content-encoding and change to Disabled
Edge: Visit edge://flags/#enable-zstd-content-encoding and change to Disabled
Opera: Visit opera://flags/#enable-zstd-content-encoding and change to Disabled
Firefox: Visit about:config
- Paste the following string into the top field: network.http.accept-encoding.secure
- Edit the value field to remove zstd
- The value field should show gzip, deflate, br after your edit.

If you need further assistance, please contact Box Product Support.

3. Box Desktop Applications' Proxy Support

Box Drive, Box Sync, Box Tools, and Box for Office are desktop applications that must connect to Box's data centers to function. The apps utilize the same domains outlined above. The apps detect and use the proxy configured for the local machine via:

Automatic Proxy Detection
Proxy Auto-Configuration (PAC file)
- Windows does not support local file path schemas for the .pac file location such as file://C:\proxy.pac
  Use a URL to configure the .pac file location.
Or manually setting the proxy server address for HTTPS protocols

For proxy authentication support:

Windows apps support NTLMv1 or NTLMv2 authentication
- Box for Office, Box Tools (machine-wide build), and Box Sync use a Windows Service that needs to connect to Box's data centers to check for new versions. The Windows Services run as the SYSTEM user, which may be unable to authenticate using NTLM. We recommend allowing SYSTEM run Services to connect through your proxy without authentication.
Mac apps support NTLMv1 authentication only.
HTTP Basic authentication (BA) is not supported.

4. Testing Connectivity to Box Domains

To test whether your browser can connect to various Box domains, go to our Connectivity Testing page. Each test image is hosted on a different Box URL.

5. Configuring Email for Box Notifications

Box uses an email service provider to deliver notification messages, such as invitations to collaborate on content when a file has been shared. To ensure your organization can receive notifications from Box, you may need to update your filters to allow email notifications to reach your users. Read Configuring Email for Box Notifications for more details.