Network & Time Sync & Environment & Certificates

• If traffic inspection or filtering systems (NGFW, DPI, proxy) are running in the infrastructure, allow WebSocket connections in them.
• You may need to configure VPN tunnels, WAF rules, or proxy servers.
• The list of required accesses may expand depending on the application architecture and the network infrastructure of the organization. Before deployment, consult the project documentation and check the connection in an isolated environment.

Common Issues with Traffic Inspection

Client-Server Channel Requirements

Call and Conference Requirements

Bandwidth calculation for calls and conferences:

Minimum Requirements for SIP Voice Calls: 16 kbps per participant.

Recommended Network Ping

If ping significantly exceeds these values, the app might not be able to connect to the server — for example, when working over satellite internet.

Client Device Bandwidth Requirements

The web app exchanges messages and media data directly with the corporate server and the Media server. Therefore, the web application needs exactly the same network access as the desktop application, plus access to the web client address.

In a split deployment, the corporate server is published externally through Front CTS, and the media service is hosted next to it. Therefore, the client always goes to Front for media data; these requests do not go to the closed network segment.

The desktop application takes proxy settings from Windows system parameters; it does not read browser settings. If exceptions for eXpress servers are specified only in the browser proxy group policy, the app will not see them and will continue to access the servers through the proxy. Set these exceptions in Windows system proxy settings: Internet Options > the Connections tab > LAN settings > Advanced, in the field Do not use proxy server for addresses beginning with.

What Windows Parameters Does the App Read?

The parameters are taken from the registry branch HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings.

How to Write an Exception so That It Works.

The app compares the exception against the name of the node it accesses. It must either match this name exactly, or be a subdomain mask with an asterisk.

If the Exceptions Are Set Correctly, but the App Still Does Not Connect.

Check the following.

• Does the list of exceptions at the time of the failure match the one you see after the connection is restored? If multiple policies with proxy settings are applied to a computer, immediately after startup the policy that doesn't have the required exceptions may take effect. Later, the correct one will override it. Capture the proxy settings at the exact moment when the app cannot connect.
• Is the certificate being replaced by an antivirus or traffic inspection tool? When substitution occurs, the app does not trust the connection, even if the proxy exceptions are set correctly. See. “Manage certificates”.
• Isn't the list of addresses allowed on the proxy too narrow? If only CTS server addresses are open, the app will connect, but some features will not work — for example, link preview. The list of required accesses is in the network access list.
• Does the proxy require authentication? The app does not support a proxy with a login and password prompt: you cannot connect through such a proxy, see the question above.

To verify that the issue is indeed the proxy, launch the application with the parameter --no-proxy-server.

eXpress has no technical restrictions on using VPN. However, the application's operation depends on the bandwidth of the VPN channel and the specifics of network protocols. If you route all traffic through VPN, including media data, call quality may drop. Try not to route traffic through the VPN.

What Must Reach the Servers Through the Tunnel

If traffic is still routed through the VPN, the tunnel must carry connections to both the corporate server over HTTPS and the Media server, including UDP. If only HTTPS is allowed through, messaging will work, but calls won't. For the list of ports, see the list of network accesses.

Common Reasons Why Media Traffic Does Not Pass Through VPN

If the user declines the browser prompt, the refusal is remembered, and no error message will appear. To avoid depending on each user's response, distribute the permission via group policies.

Chromium-Based Browsers

The policy is called LocalNetworkAccessAllowedForUrls, type — list of strings. It contains the source addresses, that is, the eXpress web app address. You don’t need to add server addresses.

Each address in the Windows registry is a separate string value (REG_SZ) with a numeric name. Example:

Example for Linux — file /etc/opt/chrome/policies/managed/express.json:

{
  "LocalNetworkAccessAllowedForUrls": ["https://corp.express"]
}

On macOS, the same policy is distributed via a configuration profile for the preference domains com.google.Chrome, com.microsoft.Edge, and similar.

Mozilla Firefox

The policy LocalNetworkAccess is used with an array of exceptions SkipDomains. The policies.json file:

{
  "policies": {
    "LocalNetworkAccess": {
      "SkipDomains": ["corp.express"],
      "Locked": true
    }
  }
}

The same via Windows group policies:

Apple Safari

There is no per-site local network access policy. Access can only be managed at the macOS level — with a permission in the Local Network section of privacy settings. Safari receives this permission automatically.

Temporarily Disabling Checks

While the infrastructure is not ready and the permission has not been distributed, checks can be disabled entirely: centrally for all browsers in the organization or manually on a single computer for diagnostics. This is an emergency measure: do not leave the checks disabled permanently.

The value 1 / true for LocalNetworkAccessRestrictionsTemporaryOptOut disables the actual blocking of requests to the local network. If a potential violation occurs, the browser only displays a warning in the developer console.

What to Consider for the Future

• The restriction is gradually being extended to more connection types. Initially it affected regular requests to the server, then WebSocket connections, and application to WebRTC is in development. When that happens, media connections will also stop working directly without the granted permission.
• The restriction does not apply if the web app itself is opened via an address within your network. If the organization deploys its own instance of the web app in a closed network segment, the problem does not arise.
• The restriction is triggered by the destination IP address; the domain name does not affect it. The same web app address may require permission in one network and not in another — this is expected behavior.

On platform servers, time is synchronized by the NTP client chrony.

If your company has its own exact time sources, specify them in the chrony configuration instead of the pool line and restart the service. You can check which sources the server is connected to with the chronyc sources -v command.

Configure persistence of browser and application profile folders between VDI sessions. Without this, users will have to sign in to the app again each time they connect through VDI.

You can use VMware Remote Console to add and remove sound cards on Windows and Linux Horizon virtual machines. To add a sound card:

1. Go to the required virtual machine in VMware Remote Console and open its settings:
   • In Windows, select VMRC > Manage > Virtual Machine Settings.
   • In Linux, select Virtual Machine > Virtual Machine Settings.
2. Open the Hardware tab and click Add.
3. Select Sound Card and click the Finish button.

In the Group Policy Editor under Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection, enable the following policies:

• Allow audio and video playback redirection
• Allow audio recording redirection

Client Certificates

Most corporate servers use standard certificates. They are already in popular client operating systems, so you don't need to install them manually. If your organization uses its own certificates, install the certificate in the device OS.

Server Certificates

Installation instructions: administrator documentation.

Certificate Verification

Refer to SSL Certificates Diagnostics.

How to Check That the Server Has Switched to Ministry of Digital Development Certificates

Open a link like https://your_server_address/system/settings/version in the browser and check the certificate details using the padlock icon in the address bar. The issuer field will show Russian Trusted Sub CA.

If the browser reports that the certificate is untrusted, the Ministry of Digital Development certificates have not yet been installed on this device.

Mass Deployment

On Windows, certificates are distributed via group policies to the local computer store. On macOS and iOS — only through a mobile device management (MDM) system or a configuration profile: only the user at the computer can manually set trust for a certificate — this cannot be done by script or remotely.