> ## Documentation Index
> Fetch the complete documentation index at: https://docs.daily.co/llms.txt
> Use this file to discover all available pages before exploring further.

# How to navigate a corporate or restrictive network

> NAT and firewall traversal products at Daily

We now have static IP ranges that you can give to your customers to solve
almost all of their networking problems, [documented
here](/docs/guides/privacy-and-security/corporate-firewalls-nats-allowed-ip-list).
The following tools are for edge cases and extremely restrictive networks.

# Advanced Firewall Control

Our Advanced Firewall Control add-on includes two features: Self-hosted IP proxy and self-hosted TURN.

## Using a self-hosted IP proxy for signaling

If Daily domains are blocked by a corporate security policy, you can fall back to routing Daily's traffic through your own HTTP and WebSocket proxy (IP proxy). This option works for products that have already deployed a web proxy that is allowed by the end-user’s IT administrator, but do not yet have Daily's signaling servers unblocked.

For an end user that observes HTTP or WSS connection failures to Daily’s infrastructure, you can reconfigure the Daily call frame to specify your own IP proxy URL. Daily will automatically use the proxy URL for subsequent network requests.

For example, if the connection to `https://gs.daily.co/` fails, a firewall will most likely return a HTTP Response code of 403 (Forbidden).

In this case, you can use your self-hosted IP proxy (e.g., `https://proxy.example.net:8080`) by specifying the `proxyUrl` property in `dailyConfig`. Daily will then send requests to `https://proxy.example.net:8080/gs.daily.co/rooms/check/sub-domain/room-name` instead of `https://gs.daily.co/rooms/check/sub-domain/room-name`.

For more details, refer to our documentation. With Prebuilt, you'll need to set [`proxyUrl`](/reference/daily-js/types/daily-call-options#param-proxy-url) property when instantiating the call frame. With Daily's client SDKs, call the [`setProxyUrl()`](/reference/daily-js/instance-methods/set-proxy-url) call object instance method.

```js theme={null}
// Example: pass configuration properties to createFrame()
call = window.Daily.createFrame({
  iframeStyle: {
    position: 'fixed',
    width: '375px',
    height: '450px',
  },
  dailyConfig: {
    proxyUrl: 'https://proxy.example.org:8080',
  },
  showLeaveButton: true,
  showFullscreenButton: true,
});
call.join({ url: 'DAILY_ROOM_URL' });
```

## Using a self-hosted TURN for media

If Daily's TURN URLs are blocked, you may fall back to routing the media through your own self-hosted TURN servers, which should already be allowlisted by the end user’s IT administrators.

Similar to the IP proxy configuration, your custom TURN servers are passed into `dailyConfig` by setting the `iceServers` property.

We encourage our customers to work with their IT departments to allowlist Daily’s TURN servers. Daily's servers are already scaled out and handle millions of media packets per second.

For more details, refer to our documentation. With Prebuilt, you'll need to set the [`iceConfig`](/reference/daily-js/types/daily-call-options#param-ice-config) property in the call frame. With Daily's client SDKs call the [`setIceConfig()`](/reference/daily-js/instance-methods/set-ice-config) instance method.

```js theme={null}
call = window.Daily.createFrame({
  iframeStyle: {
    position: 'fixed',
    width: '375px',
    height: '450px',
  },
  dailyConfig: {
    iceConfig: {
      iceServers: [
        {
          urls: ['stun:turnserver.example.org', 'turns:turnserver.example.org'],
          username: 'webrtc',
          credential: 'turnpassword',
        },
      ],
      placement: 'replace',
      iceTransportPolicy: 'all',
    },
  },
  showLeaveButton: true,
  showFullscreenButton: true,
});
call.join({ url: 'DAILY_ROOM_URL' });
```