Issue description

The Shining3D Dental Cloud website or software may fail to load, launch, sign in, synchronize, upload a case, download a case, or receive realtime status updates when required outbound network connections are blocked, redirected, inspected, or resolved incorrectly.

Root cause

Common causes include incomplete firewall allow rules, stale DNS answers, static HOSTS-file mappings, proxy restrictions, TLS/SSL inspection, blocked MQTT traffic, geographic restrictions, and rules that prevent Alibaba / Tencent infrastructure / AWS services.

Resolution

Use domain-based outbound allow rules and permit the required TCP ports. The service uses dynamic cloud infrastructure, load balancers, CDNs, and object-storage addresses; permanent rules based on individual IP addresses are not reliable.

Current Hybrid-Cloud Behavior

1. Required firewall rules - allow by domain

Domain-based rules are preferred. 

Allow the presented Shining3D names and, where the DNS-security product evaluates CNAME targets independently, allow the documented cloud target names as well.

Core Shining3D services

• *.dental3dcloud.com - Dental Cloud web and realtime services
• www.dental3dcloud.com - Dental Cloud website
• s.dental3dcloud.com - Observed cloud portal over HTTPS and secure MQTT/realtime endpoint
• mqtt.dental3dcloud.com - Published MQTT endpoint
• *.shining3d.com - Shining3D APIs, downloads, and assets
• api.shining3d.com - Primary API
• sapi.shining3d.com - Current application API
• down.shining3d.com - Historical/legacy case downloads

AWS services

• s3.us-west-2.amazonaws.com - Observed case and resource storage
• *.s3.us-west-2.amazonaws.com - AWS virtual-hosted S3 buckets
• cloud3dpub.s3.us-west-2.amazonaws.com - Observed public assets/modules
• cdnimg.dental3dcloud.com - Observed AWS CloudFront content endpoint
• d3vwcqpawxuj6n.cloudfront.net - Conditional: observed CloudFront CNAME when DNS security evaluates targets independently
• *.elb.us-west-2.amazonaws.com - Conditional: allow only when DNS/CNAME security requires the AWS target name

Alibaba services - retain for older cases and CDN 

• *.aliyun.com - Alibaba Cloud services
• *.aliyuncs.com - Alibaba object storage and service endpoints
• cloud3data.oss-us-west-1.aliyuncs.com - Observed older-case object storage
• cdnimg.shining3d.com - Observed Shining3D image/CDN endpoint
• cdnimgcn.shining3d.com - Observed Shining3D China-oriented CDN endpoint
• *.cdngslb.com - Conditional: CDN CNAME target when evaluated by DNS security
• 
  

Tencent services - legacy or region-dependent

The reviewed US workflows did not contact Tencent. Keep the existing Tencent entries for regions, versions, or modules that still require them.

• *.tencentcloudapi.com
• *.tencentcloud.com
• *.myqcloud.com
• *.qcloudcdn.com
• *.tcdn.qq.com

2. Required outbound ports

3. TLS/SSL inspection and proxy requirements

The system uses TLS-encrypted APIs, object storage, secure MQTT, WebSockets, and long-lived sessions.

• Bypass SSL/TLS inspection for *.shining3d.com and *.dental3dcloud.com.
• Bypass inspection for the AWS S3 and Alibaba OSS/CDN domains listed above.
• Permit TLS 1.2 or later, SNI, normal certificate-chain validation, and long-lived TCP sessions.
• Ensure explicit or authenticated proxies allow background Shining3D services, WebSockets, and MQTT; browser-only proxy access is insufficient.
• Do not intercept or replace certificates on MQTTS port 8883 or alternate transport port 8084.

4. IP and ASN guidance

Allow by domain whenever possible. AWS, Alibaba, Tencent, ELB, S3, OSS, and CDN addresses are dynamic and may change without notice. Do not place current cloud IP addresses permanently in the Windows HOSTS file.

• AWS: use the official AWS IP range feed and filter for the required region/services when an IP-only product cannot use FQDN rules.
• Alibaba: observed services can use AS45102 and Alibaba-hosted CDN addresses in AS24429.
• Tencent: the previous article identified AS132203; keep only when required by the applicable region or product.

Observed address examples - troubleshooting only

5. Legacy direct connections on TCP 2023

Some product versions may use direct Asia endpoints on TCP 2023. These are examples only and are not a complete or permanent allowlist:

• 101.200.34.79:2023
• 120.79.12.238:2023
• 47.110.42.55:2023
• 47.96.154.69:2023
• 8.140.201.23:2023

Confirm the current TCP 2023 destination list with Shining3D Support before implementing IP-specific rules. Traffic from unrelated security, remote-support, or network-access software must not be attributed to Shining3D solely because it uses the same port.

6. Antivirus and endpoint-security exclusions

If endpoint security is enabled, add only the applicable installation and working paths:

• Intraoral Scanner: C:\Shining3D\DentalLauncher
• Desktop Scanner: C:\Shining3D\DentalScan
• Facial Scanner: C:\FSLauncher
• Order save path: C:\DentalOrder
• Algorithm diagnostic files: C:\ShiningWork

Use the organization’s normal change-control process. Do not disable the firewall or endpoint-security product as a permanent solution.

Refer to article for broader allowlist:

IT Security, Firewall, Antivirus, and Network Filtering Issues : Dental Support

7. Validation after applying the allowlist

Validate each workflow separately because current and historical cases may use different storage providers:

1. Launch the software and sign in.
2. Open Dental Cloud and confirm synchronization completes.
3. Upload a newly created test case; current behavior should reach AWS S3 over TCP 443.
4. Download that new test case; current behavior should reach AWS S3 over TCP 443.
5. Download at least one case created before the migration; it may reach down.shining3d.com and Alibaba OSS over TCP 443.
6. Open modules and asset-heavy features to validate AWS S3 and the Shining3D CDN domains.
7. Confirm a stable secure MQTT connection on TCP 8883 and normal realtime/job-status updates.

Expected validation results

8. Troubleshooting

• Check the Windows HOSTS file and remove static Shining3D API mappings.
• Clear the DNS client cache and resolve api.shining3d.com, sapi.shining3d.com, and s.dental3dcloud.com again.
• The API names should resolve through current dynamic infrastructure; do not expect a single permanent IP.
• Compare the organization’s DNS answer with an approved independent resolver when stale or filtered DNS is suspected.
• Review proxy, firewall, DNS-security, web-filter, endpoint-security, and SSL-inspection logs for the exact failure time.
• If new cases work but older cases fail, verify Alibaba OSS and down.shining3d.com remain allowed.
• If API/login works but status updates fail, verify TCP 8883 and long-lived MQTT sessions.