1. Firewall Allowlist Domains/Hostnames
Here are the domains/hostnames that need to be allowlisted for Box and its applications, integrations, and components to work correctly. Box will notify you of any changes in this list through product announcements. Box recommends regularly checking this page to stay updated. It is important to update your firewall whenever there are any changes. Configure firewall allowlist with any subdomain and Hosts of Box Core domains and any other related services.1a. Box Core Domains
Note:Best practice is to use our site’s domain names instead of a particular site IP address. IP addresses can change frequently and without notice.
1b. Other related service Domains/Hosts
- Box for Office Integration: To use the Box for Office Online integration and Excel Online Previewer, allow Office 365 URLs and IP address ranges.
- Box for Google Workspace: To use the Box for Google Workspace, please go to the Google support pages for the hostnames you must allow. (You can ignore the Google Drive/drive IP addresses because this Box integration does not have a dependency on Google Drive.)
- Box for iWork Integration: To use the Box for iWork integration, you must allow access to Apple’s network at
17.0.0.0/8 - Optionally, if using an IP allowlist, be sure to allow the IPs listed on https://www.cloudflare.com/ips/
1c. Specific hostnames
If you cannot allow the wildcard domains shown in the two lists above, allow these specific hostnames:- Box for Office Integration: To use the Box for Office Online integration and Excel Online Previewer, allow Office 365 URLs and IP address ranges.
- Box for Google Workspace: To use the Box for Google Workspace, please go to the Google support pages for the hostnames you must allow. (You can ignore the Google Drive/drive IP addresses because this Box integration does not have a dependency on Google Drive.)
- Box for iWork Integration: To use the Box for iWork integration, you must allow access to Apple’s network at
17.0.0.0/8 - Optionally, if using an IP allowlist, be sure to allow the IPs listed on https://www.cloudflare.com/ips/
2. Port and connection details:
Enable HTTPS port 443 TCP for the domains above, and allow Web Socket protocol wss://.To connect with HTTP/3 (QUIC), Box recommends you also optionally enable port 443 UDP.
Note:Box is integrating ZSTD (Zstandard) compression (rfc8878) to improve performance and reduce bandwidth usage when supported by the client’s browser (see Product Announcement). ZSTD is a lossless data compression technique that accelerates page loading from Box. By default, the browsers Chrome, Edge, Firefox, and Opera enable ZSTD compression. It is important to be aware that ZSTD previously encountered compatibility issues with FortiGate and Zscaler but are now resolved. Although unlikely, other firewalls that perform deep packet inspection (DPI) may encounter issues with Box’s ZSTD implementation. To ensure optimal functionality, we recommend that network administrators either upgrade their firewall/proxy systems to versions that support ZSTD compression, or to disable HTTPS packet inspection in your firewall/proxy for the domains
*.box.com and *.boxcloud.com . Making these changes will help maintain the integrity and efficiency of data transfers.- Firefox: Visit
about:config- Paste the following string into the top field:
network.http.accept-encoding.secure - Edit the value field to remove
zstd - The value field should show
gzip, deflate, brafter your edit.
- Paste the following string into the top field:
3. Box Desktop Applications’ Proxy Support
Box Drive, Box Sync, Box Tools, and Box for Office are desktop applications that must connect to Box’s data centers to function. The apps utilize the same domains outlined above. The apps detect and use the proxy configured for the local machine via:- Proxy Auto-Configuration (PAC file)
- Windows does not support local file path schemas for the .pac file location such as
file://C:\proxy.pac
Use a URL to configure the .pac file location.
- Windows does not support local file path schemas for the .pac file location such as
- Windows apps support NTLMv1 or NTLMv2 authentication
- Box for Office, Box Tools (machine-wide build), and Box Sync use a Windows Service that needs to connect to Box’s data centers to check for new versions. The Windows Services run as the SYSTEM user, which may be unable to authenticate using NTLM. We recommend allowing SYSTEM run Services to connect through your proxy without authentication.