Network configuration for TrueTest
Last updated: August 2026
If your application under test is hosted in a highly secure network, you might want to whitelist Katalon TrueTest infrastructure public IPs & endpoints.
Internet facing components​
| Component | Usage |
|---|---|
[https://katalon-api.katalon.com](https://katalon-api.katalon.com) | TrueTestservice endpoints: the web application interacts with this RESTful service to handle all TrueTest business such as configuring AUT, environments. |
[https://kip.katalon.com](https://kip.katalon.com) | TrueTest traffic ingestion endpoints: the traffic agent runs inside customer's web applications and uses this endpoint to send traffic data to TrueTest backend. |
44.212.203.21554.161.107.19952.22.58.98 | NAT gateways: the gateways to the Internet for outgoing network operation components. The NAT gateways has specific public IPs (or IP range) for easy white-listing if needed. |
| Issue | Solution | Whitelist |
|---|---|---|
| The AUT website is behind a firewall (but publicly accessible) | Whitelist NAT gateway public IPs | NAT GW IP addresses |
| The Git repository is hosted by a server behind a firewall | Whitelist NAT gateway public IPs | NAT GW IP addresses |
Check Content Security Policy compatibility​
The TrueTest browser extension can check whether the active page's Content Security Policy (CSP) allows the Traffic Agent script and API connections for the selected environment.
- Open the application page you want TrueTest to track.
- Open the TrueTest extension popup.
- Review the CSP status and the required script and API origins.
- If the status is Likely blocked or Review, compare the displayed enforced policy with the required origins and update the application's
script-src-elem,script-src,connect-src, ordefault-srcdirectives as needed. - Reload the page after updating the CSP, then open the extension again to confirm the new status.
The extension can report Allowed, Likely blocked, Review, No CSP, or Unknown. An Unknown status means the extension has not observed the current page load; reload the page and check again. A report-only policy appears for diagnostic context and does not block the Traffic Agent by itself.