Network and security requirements for Q-Play and Q-Cal
Introduction
This guide is for the IT department that connects Q-Play players and Q-Cal to your network. It lists the addresses and ports that must be open, and explains how NordicScreen protects your data.
Players only make outgoing, encrypted connections to the NordicScreen cloud. You never need to open incoming ports.
1. Connect players to your network
Outgoing connections only
Connect players directly to your internal network. You do not need to open any incoming ports in the firewall.
Encrypted connection
Players connect to the Q-Play cloud servers over SSL on port 443 only.
Separate network for larger organisations
If your network is complex, place the players on a dedicated VLAN, so they are isolated from the rest of your network.
Wi-Fi
Use a network where access does not expire. Guest networks often expire after 24 hours. See Be aware of this when you are using wifi.
2. Ports to open in the firewall
If your firewall only allows specific traffic, open these ports for outgoing traffic from the players:
| Port | Protocol | Used for |
|---|---|---|
| 53 | UDP and TCP | DNS lookup |
| 443 | TCP | HTTPS connection to the NordicScreen servers |
| 80 | TCP | Only if you show RSS feeds or news from websites that do not use HTTPS |
Players also need access to the external sources you show on the screens, for example news feeds and YouTube.
3. Addresses for Q-Play V2
Allow traffic from the players to these addresses:
| Address | IP address | Port |
|---|---|---|
app.q-play.io | 163.172.188.220 | 443 (TCP) |
api.q-play.io | 163.172.188.220 | 443 (TCP) |
94.playerapi.q-play.net | 163.172.188.220 | 443 (TCP) |
97.playerapi.q-play.net | 163.172.188.220 | 443 (TCP) |
98.playerapi.q-play.net | 163.172.188.220 | 443 (TCP) |
Q-Play V2 integration servers
If you limit access to a third-party service with IP whitelisting, allow these IP addresses: 88.99.85.147, 167.235.239.183, 142.132.160.124, 116.203.85.242. Read more in How your Q-Play integrations are secured.
4. Addresses for Q-Play V1
If you still use Q-Play V1, allow traffic from the players to these addresses:
| Address | IP address | Port |
|---|---|---|
app.q-play.net | 78.46.149.23 | 443 (TCP) |
app.tdplay.dk | 195.201.28.125 | 443 (TCP) |
storage3.q-play.net | 195.201.31.193 | 443 (TCP) |
wc.q-play.net | 159.69.0.117 | 443 (TCP) |
1.playerapi.q-play.net | 116.203.16.33 | 443 (TCP) |
2.playerapi.q-play.net | 78.47.204.28 | 443 (TCP) |
5. Addresses for Q-Cal
| Address | IP address | Port | Used for |
|---|---|---|---|
app.q-cal.net | 116.203.85.242 | 443 (SSL) | Web service |
controller.q-cal.net | 116.203.23.160 | 11812 (SSL) | Web service |
AD/O365 synchronisation: if you limit access, allow communication with sync.q-cal.net (142.132.160.124) and app.q-cal.net (116.203.85.242).
It is enough to allow traffic to and from the IP addresses and ports above. SSL/TLS is required. For IoT devices, see IOT Security and Data Communication.
6. Security in the Q-Play editor
All communication between users and the Q-Play editor runs over an encrypted HTTPS connection on port 443.
7. How your data is separated and protected
Separation between accounts
Q-Play V2 is built on the Laravel framework. Accounts are separated in the database with tenant scoping (global scopes), which is the recommended way to run several customers on one database.
Encrypted login details
Login details for integrations are encrypted with AES-256. NordicScreen employees do not have access to them. The data is stored only on the integration server that runs your integrations.
8. Hosting and access to our servers
Hosting
Our servers are hosted in Germany with Hetzner.
Private network
NordicScreen runs its own private network with a static IP address. It is the only way into our critical systems.
No direct internet access
The servers cannot be reached directly from the internet. Only a few trusted employees with management responsibility have access. Support and sales staff do not.
Layered access protection
Access to critical systems requires IP whitelisting, user authentication and SSH certificates. Together, these work as multi-factor authentication.
9. Next steps
If you integrate Microsoft services such as Power BI, see Configuring MFA and Microsoft Users for Secure Integration with Q-Play.
10. Frequently asked questions
Do we need to open incoming ports?
No. Players only make outgoing connections, mainly on port 443.
Which addresses should we allow?
Use the list for the Q-Play version you have. Q-Play V2 is in section 3, and Q-Play V1 is in section 4.
Why should we open port 80?
Only if you show RSS feeds or news from websites that do not support HTTPS.
Can NordicScreen see our integration passwords?
No. They are encrypted with AES-256, and NordicScreen employees do not have access to them.
Where is our data stored?
On servers in Germany, hosted with Hetzner.
How do we limit access to our own services?
Allow only the IP addresses of the Q-Play V2 integration servers in section 3.