Network & Time Sync & Environment & Certificates

For Administrators: About Network Accesses for Clients & Servers, Traffic Inspection

• If traffic inspection or filtering systems (NGFW, DPI, proxy) are used in the infrastructure, WebSocket connections must be allowed.
• Additionally, VPN tunnel configuration, WAF rules, or proxy server settings may be required.
• Depending on the application's architecture and the specifics of the organization's network infrastructure, the list of necessary access permissions may expand—it is recommended to consult the project documentation and test the connection in an isolated environment before deployment.

Common Issues with Traffic Inspection

For Administrators: Network Requirements

Client-Server Channel Requirements

Call and Conference Requirements

Bandwidth calculation for calls and conferences:

Minimum Requirements for SIP Voice Calls: 16 kbps per participant.

Recommended Network Ping

When these values are significantly exceeded, the app may be unable to connect to the server — for example, when using satellite internet.

Client Device Bandwidth Requirements

Messaging and media data from the web app go directly to the corporate server and the Media server, so the web app requires exactly the same network accesses as the desktop app, plus access to the web client address.

In a split deployment, the corporate server is published externally through Front CTS, and the media service is located next to it, so the client always retrieves media data from the Front, not from the closed network segment. Network connectivity matrices by deployment topology:

• Front CTS and Back CTS
• Networking requirements (all topologies)
• Additional networking for client app operation

To the Administrator: What Proxy Settings the Desktop App Uses and How to Set Exceptions on Windows

The desktop application takes proxy settings from Windows system parameters, not from the browser. If exceptions for eXpress servers are specified only in the browser proxy group policy, the app will not see them and will continue to access the servers through the proxy. Set these exceptions in Windows system proxy settings: Internet Options > the Connections tab > LAN settings > Advanced, in the field Do not use proxy server for addresses beginning with.

What Windows Parameters Does the App Read?

The parameters are taken from the registry branch HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings.

How to Write an Exception so That It Works.

The exception is compared with the host name that the app is accessing. It must either match this name exactly, or be a subdomain mask with an asterisk.

If the Exceptions Are Set Correctly, but the App Still Does Not Connect.

Check the following.

• Does the list of exceptions at the time of the failure match the one you see after the connection is restored? If multiple policies with proxy settings are applied to a computer, immediately after startup the policy that doesn't have the required exceptions may take effect, and later the correct one will override it. Capture the proxy settings at the exact moment when the app cannot connect.
• Is the certificate being replaced by an antivirus or traffic inspection tool? When substitution occurs, the app does not trust the connection, even if the proxy exceptions are set correctly. See. “Manage certificates”.
• Isn't the list of addresses allowed on the proxy too narrow? If only CTS server addresses are open, the app will connect, but some features will not work — for example, link preview. The list of required accesses is in the network access list.
• Does the proxy require authentication? The app does not support a proxy with a login and password prompt: you cannot connect through such a proxy, see the question above.

You can verify that the issue is indeed the proxy by launching the application with the parameter --no-proxy-server.

For Administrators: What Are the Limitations When Routing All eXpress Traffic Through a VPN Tunnel?

eXpress has no technical restrictions on using VPN. However, in practice, performance depends heavily on the VPN channel's bandwidth and the specifics of network protocols. Experience shows that routing all traffic, including media data, through VPN can lead to call quality issues. It is recommended to avoid routing traffic through VPN to ensure stable operation.

What Must Reach the Servers Through the Tunnel

If traffic is still routed through VPN, it is not enough to allow only HTTPS to the corporate server — otherwise messaging will work, but calls will not. Connections to the Media server, including UDP, must also pass through the tunnel. For the list of ports, see the list of network accesses and the networking guides.

Common Reasons Why Media Traffic Does Not Pass Through VPN

For Administrators: Centralized Local Network Access Deployment (Policies)

Relying on each user to respond correctly to the browser prompt is not advisable: the denial is remembered, and no error message is shown. The permission can be distributed via group policies.

Chromium-Based Browsers

The policy is called LocalNetworkAccessAllowedForUrls, type — list of strings. It contains the source addresses, that is, the eXpress web app address, not the server addresses.

Each address in the Windows registry is a separate string value (REG_SZ) with a numeric name. Example:

Example for Linux — file /etc/opt/chrome/policies/managed/express.json:

{
  "LocalNetworkAccessAllowedForUrls": ["https://corp.express"]
}

On macOS, the same policy is distributed via a configuration profile for the preference domains com.google.Chrome, com.microsoft.Edge, and similar.

Mozilla Firefox

The policy LocalNetworkAccess is used with an array of exceptions SkipDomains. The policies.json file:

{
  "policies": {
    "LocalNetworkAccess": {
      "SkipDomains": ["corp.express"],
      "Locked": true
    }
  }
}

The same via Windows group policies:

Apple Safari

There is no per-site local network access policy. Management is possible only at the macOS level — through the permission in the Local Network section of privacy settings, which Safari obtains automatically.

Temporarily Disabling Checks

While the infrastructure is not ready and the permission has not been distributed, checks can be disabled entirely — both centrally for all browsers in the organization and manually on a single computer for diagnostics. This should be an emergency measure, not a permanent setting.

The value 1 / true for LocalNetworkAccessRestrictionsTemporaryOptOut does not just hide the warning: it disables the blocking of local network requests itself — instead of blocking, the browser only outputs a warning in the developer console when a potential violation occurs.

What to Consider for the Future

• The restriction is gradually being extended to more connection types. Initially it affected regular requests to the server, then WebSocket connections, and application to WebRTC is in development. When that happens, media connections will also stop working directly without the granted permission.
• The restriction does not apply if the web app itself is opened via an address within your network. If the organization deploys its own instance of the web app in a closed network segment, the problem does not arise.
• The restriction is determined by the destination IP address, not by the domain name. The same web app address may require permission in one network and not in another — this is expected behavior.

On platform servers, time is synchronized by the NTP client chrony. Installation and configuration are described in the operating system preparation sections: Astra Linux, RED OS, Ubuntu and Debian.

If your company has its own exact time sources, specify them in the chrony configuration instead of the pool line and restart the service. You can check which sources the server is connected to with the chronyc sources -v command.

You need to configure the persistence of browser and application profile folders between VDI sessions. Otherwise, users will have to sign in to the application again each time they reconnect through VDI.

You can use VMware Remote Console to add and remove sound cards on Windows and Linux Horizon virtual machines. To add a sound card:

1. Go to the required virtual machine in VMware Remote Console and open its settings:
   • In Windows, select VMRC > Manage > Virtual Machine Settings.
   • In Linux, select Virtual Machine > Virtual Machine Settings.
2. Open the Hardware tab and click Add.
3. Select Sound Card and click the Finish button.

In the Group Policy Editor under Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection, enable the following policies:

• Allow audio and video playback redirection
• Allow audio recording redirection

Client Certificates

Most corporate servers use standard certificates included in popular client operating systems, which do not require manual installation. When using organization's own certificates, install the certificate in the device's OS.

Server Certificates

Installation instructions: administrator documentation.

Certificate Verification

Refer to SSL Certificates Diagnostics.

How to Check That the Server Has Switched to Ministry of Digital Development Certificates

Open a link like https://your_server_address/system/settings/version in the browser and check the certificate details using the padlock icon in the address bar. The issuer field will show Russian Trusted Sub CA.

If the browser reports that the certificate is untrusted, the Ministry of Digital Development certificates have not yet been installed on this device.

Mass Deployment

On Windows, certificates are distributed via group policies to the local computer store. On macOS and iOS — only through a mobile device management (MDM) system or a configuration profile: only the user at the computer can manually set trust for a certificate — this cannot be done by script or remotely.