Meet.jit.si not working for more than 2 from inside corp proxy/firewall

we are looking to use meet.jit.si to enable us to train some new staff in a work from home environment.
Our infrastructure and IT department does not lend itself to installing our own jit.si server.

we are connected via VPN to our corporate network, VPN sets ALL traffic to use vpn tunnel resulting in all web traffic using the corporate proxy and firewall.

meet.jit.si works perfectly fine video and audio when only 2 are connected and both are “internal” if a third person connects (internal OR external) video and audio immediately fail and only the chat works. as soon as the 3rd drops out everything works again.

also of note 1 to 1 does not work if one is internal and another external.

while the issue we are experiencing does not stop us utilising meet.jit.si (1 to 1 is all we really need) it does mean that a manager/trainer/team leader can’t drop in to a session.

could it be that a particular site or IP range is being blocked from our side that would allow 3+ and external <> internal to function?

EDIT:
Looking at console logs of the page when a 3rd (or external) joins i see lines of:
WebSocket connection to ‘wss://meet-jit-si-ap-se-2a-s68-jvb-12-13-4.jitsi.net/…’ failed: Error during WebSocket handshake: Unexpected response code: 403

could it be that my corp firewall is blocking that ‘site’ (i know ist a websocket)… i have no real way of testing this - does that address change at all or is it ALWAYS meet-jit-si-ap-se-2a-s68-jvb-12-13-4.jitsi.net? if so i could ask for that address to be whitelisted and that may solve my issue.

Adam,
I’m seeing the same thing at work. I can connect between 2 devices (computer/phone) and it’s OK but as soon as I add a third the video and audio drop. From searching here I added a rule to allow UDP 10000 but your logs make me think it’s because it’s trying to connect to “jitsi.net”.
I could add a rule for that to our firewall but it requires an IP address, and as you point out, we’d need to know all the possible addresses.