AIRLOCKPlay Gate

Allowlist

Official Play domains

No fixed short IP list. Allow these names on TCP 443. FCM also uses 5228–5230 and 5235–5236.

Do not block

  • play.google.com
  • play.googleapis.com
  • android.clients.google.com

TCP 443

HTTPS — Play UI, APIs, downloads

TCP/UDP 5228–5230

Play / FCM

TCP 5235–5236

FCM XMPP

Store

2

  • play.google.com

    Store UI

  • googleplay.com

    Brand domain

API

11

  • play.googleapis.com

    Play APIs

  • play-fe.googleapis.com

    Frontend API

  • android.clients.google.com

    Client / download API

  • android.googleapis.com

    Android APIs

  • prod-lt-playstoregatewayadapter-pa.googleapis.com

    Play gateway

  • clients2.google.com

    Shared Google backends

  • clients3.google.com

    Shared Google backends

  • clients4.google.com

    Shared Google backends

  • clients5.google.com

    Shared Google backends

  • clients6.google.com

    Shared Google backends

  • pki.google.com

    Certificate checks

CDN

7

  • play-lh.googleusercontent.com

    App icons / screenshots

  • play-games.googleusercontent.com

    Play Games assets

  • play-apps-features.googleusercontent.com

    Feature assets

  • googleusercontent.com

    User / app content

  • *.gvt1.com

    App / update CDN

  • *.ggpht.com

    Images

  • *.gstatic.com

    Static content

Push

4

  • fcm.googleapis.com

    Push

  • fcm-xmpp.googleapis.com

    Push XMPP

  • gcm-http.googleapis.com

    Legacy GCM HTTP

  • gcm-xmpp.googleapis.com

    Legacy GCM XMPP

Connectivity

5

  • android.com

    Android connectivity

  • *.gvt2.com

    Play connectivity checks

  • *.gvt3.com

    Play connectivity checks

  • connectivitycheck.android.com

    Network check

  • connectivitycheck.gstatic.com

    Network check

Downloads

2

  • dl.google.com

    Downloads

  • dl-ssl.google.com

    SSL downloads