Overview
Each new filespace initialised will have a unique fully qualified domain name. This, along with the chosen S3 Object Storage, the discovery service and the Web Service, requires exclusions for any network security or antivirus that is running on a client instance.
Firewall requirements
In order for the LucidLink client to work behind a firewall, the following connections on TCP/IP port 443 must be enabled:
-
<filespaceID>.fs.lucidlink.com- Filespace ID, as the fully qualified domain name (FQDN).
As an example:0a00a00a-bb11-22cc-333d-4e44e44e4444.fs.lucidlink.com -
s3.<region>.amazonaws.com- Object storage endpoint. -
discovery-service.lucidlink.com- LucidLink discovery service. -
api.lucidlink.com- LucidLink web service. -
app.lucidlink.com- LucidLink web app.
Disable SSL certificate inspection or deep packet inspection for LucidLink traffic, and add a DPI bypass rule (SSL inspection exclusion). Intercepting or decrypting traffic causes secure connection failures.
If your network strictly blocks outbound HTTP traffic, allow HTTP port 80 to *.amazontrust.com.
Obtain your filespace ID and object storage endpoint
Connect your filespace.
Open your terminal or command prompt.
Run the following command:
lucid status
Antivirus exclusions
All LucidLink Processes: Any running executable associated with the LucidLink application.
LucidLink Client Files: The local configuration, cache, and application directories. For example, the .lucid folder at
/user/.lucid(default cache location).The Mounted Filespace: The specific drive letter or directory mount point where your filespace is mounted.
Network optimizations
VPN / ZTNA: Disable VPNs or configure split tunneling to if VPN is required.
Cloud Sync Clients: Exclude mounted filespaces from third-party sync or indexing applications.
Additional details
Antivirus
To ensure optimal performance and stability, we highly recommend configuring your antivirus (AV) software to exclude LucidLink from active scanning. Because LucidLink streams data in real-time, real-time AV scanning can inadvertently trigger performance bottlenecks. Implementing these exclusions can prevent common stability issues.
Why is this necessary? Standard background AV scanning can conflict with the live streaming nature of a filespace, potentially leading to temporary data access issues or delays.
Deep Packet Inspection (DPI) & SSL Inspection
With a bypass in place, the firewall forwards LucidLink TLS sessions without interception, LucidLink's own certificates are presented to the client unmodified, and there is no inspection overhead on object store traffic.
Firewall Configuration
Encrypted LucidLink client filesystem data is communicated securely with our service via Transmission Control Protocol/Internet Protocol (TCP/IP) port 443 and the Object Store (S3 compatible Bucket or Azure Container) using the Object Storage credentials provided.
All Object Storage transfers are performed with Advanced Encryption Standard (AES-256) end-to-end, client-side authenticated encryption through the LucidLink Windows, macOS or Linux client and Filespace user access-controlled filesystem credentials.
LucidLink client communicates with AES-256 encryption via TCP/IP port 443 with our Discovery Service for the purpose of Namespace verification and Metadata coordination.
Additionally, we use certificates signed by our internal certificate authority (CA).
Some firewalls do Secure Sockets Layer (SSL) decryption (aka Deep Packet Inspection (DPI) or SSL Certificate Inspection). This is interpreted as a man-in-the-middle attack by injecting their own CA into the trusted store and using it to impersonate the accessed service.
In case of an on-premises, local object storage, the inbound traffic on the port the filespace was initialized must also be enabled. All data and proprietary metadata of the Filespace are client-side encrypted. They never go in decrypted form, even in LucidLink internal traffic. LucidLink services have a zero-knowledge policy. Even if a firewall wants to analyze the traffic it will still be encrypted.
In highly secure or isolated network environments, administrators may need to allow outbound HTTP connections on port 80 to *.amazontrust.com for proper SSL certificate validation. The SSL certificate for https://app.lucidlink.com is issued by Amazon Trust Services and is configured to perform OCSP (Online Certificate Status Protocol) revocation checks via HTTP to Amazon's certificate authority endpoints.
If outbound HTTP traffic on port 80 is blocked, the OCSP revocation check will fail, resulting in an unsuccessful SSL certificate validation and preventing the establishment of secure connections to app.lucidlink.com. To maintain proper certificate validation functionality, environments with restricted outbound HTTP traffic should ensure that port 80 connections to *.amazontrust.com are allowed.
If the firewall does SNI-based allowlisting rather than DNS/IP filtering, then a <filespaceID>.lucid.link or *.lucid.link allow rule may be required.
Software Contention
VPN's route your traffic through an intermediary server, which introduces latency and bandwidth overhead. LucidLink works by streaming file data on-demand directly from cloud storage, so it's highly sensitive to network performance. If your VPN forces all traffic through the tunnel, LucidLink's cloud storage traffic takes an inefficient path instead of going directly to the nearest cloud region. If VPNs are required, then we recommend a split tunnelling configuration to isolate the LucidLink traffic.
Zero Trust Network Access (ZTNA) agents - often show the same bottleneck issues as VPNs.
Cloud Sync Clients - compete for I/O and bandwidth, especially if they try to index or sync the LucidLink mount point.
Software
Linux Dependencies: FUSE (Filesystem in Userspace) is automatically installed as a dependency on Linux systems.
Windows & macOS Drivers: LucidFS drivers are packaged directly within the installer.
TLS Requirements: Most storage providers require TLS 1.2 or higher.