Linux remote desktop network requirements
Authentication, registration and signaling use HTTPS. Media uses a separate direct or relay path. A successful login or heartbeat does not establish media reachability.
Required traffic
| Path | Protocol and port |
|---|---|
| VDO authentication and signaling | HTTPS TCP 443 to VDO product/API hosts |
| Managed relay publisher | UDP 4444 from the host to the assigned regional relay |
| Browser relay subscriber | UDP 4443 or TCP 4443 WebSocket fallback to the assigned relay |
| Native QUIC relay subscriber | UDP 4444 from the native Workstation client to the assigned relay |
| Direct QUIC | Reachable peer UDP ports on host and client addresses |
Browser TCP fallback still requires the host's UDP 4444 publisher. There is no managed remote-desktop media fallback over HTTPS 443 alone. A UDP-blocked network is not qualified by its working login page.
Direct and relay paths
Direct QUIC is preferred when peer connectivity succeeds; relay is the alternative. Direct depends on NAT, routing and local firewall reachability, not only outbound UDP permission. Relay does not require permanent port forwarding to the workstation.