Venues are relays that join your browser to your systems, so neither side needs an inbound port or a public address. If your organisation can't use a shared relay, you can run your own private venues and force traffic through your venues.
How venues work
Your console runs in a browser; your systems sit in data centres, offices and cloud accounts. Usually neither can open a connection to the other, because both are behind firewalls with potentially no public IP address.
A venue sits in between. The console connects out to a venue, the system connects out to a venue, and the venue joins them.
For your network, this means connections are outbound-only at both ends. You don't open inbound ports, and a system doesn't need a public address to be reachable. For the port, domain and bandwidth to give your network team, see A session is slow or won't connect.
See which venue a session is using
Inside a session, open Info > Connection details. Current venue shows , along with the connection type and latency.
When to run your own
You can install and manage private venues if:
Data must stay in a jurisdiction or network you control.
A contract rules out third-party relays.
Your network doesn't allow outbound connections to a vendor's infrastructure.
Make all traffic use your private venues
Go to Admin > Account Settings.
Turn on Private venues only.
Your systems will then only use private venues your account owns; shared venues are left out. With the setting off, systems can still use a shared venue.
NOTE: With Private venues only turned on, there is no fallback. If none of your private venues is reachable, no one can connect. Run at least two, and monitor them.
What running a private venue involves
A private venue is infrastructure to look after:
A certificate. Venues terminate TLS, and you manage the certificate.
A name and a public address. A venue needs a resolvable FQDN and a public IP. A venue with a private IP address can't be made public.
Health checks. Venues are health-checked.
Registration. Registration uses a token that expires.
Logs. Like systems, venues have logs you can fetch and a log level you can set.
Upgrades. Venues are upgraded, and an upgrade takes time. A venue must be disabled before it can update itself.
A venue moves through these states: UNINSTALLED, REGISTERED, ACTIVE, DISABLED, SUSPENDED and DECOMMISSIONED. It must be DECOMMISSIONED before it can be deleted. For the related error codes, see the Error and status message index.
Who can manage venues
Managing venues needs the Manage private venues permission. Give it out carefully, because it controls the route every session in the account takes.