👋 Welcome to the Link Help Center
Find the answers you need—fast and easy
Help Center / Audio/video deployment and use / Firewall and Port Configuration
Firewall and Port Configuration
1. Recommended Firewall Rules
When Caddy provides HTTPS/WSS and LiveKit uses its default RTC port range, configure the following rules:
| Port | Protocol | Source | Purpose | Required |
|---|---|---|---|---|
80 |
TCP | Public internet | ACME certificate validation and HTTP-to-HTTPS redirect | Required |
443 |
TCP | Public internet | LiveKit HTTPS API and WSS signaling endpoint | Required |
7881 |
TCP | Public internet | WebRTC ICE/TCP fallback when UDP is unavailable | Required |
50000-60000 |
UDP | Public internet | WebRTC audio/video media transport | Required |
3478 |
UDP | Public internet | Built-in TURN/UDP and STUN | Required when TURN/UDP is enabled |
5349 |
TCP | Public internet | TURN/TLS | Required when a standalone TURN/TLS service is enabled |
7880 |
TCP | Local host or trusted private network | Internal LiveKit API/WebSocket listener | Must not be exposed directly to the public internet |
Because public client addresses are not fixed, media ports normally need to allow 0.0.0.0/0. When IPv6 is enabled, configure an equivalent ::/0 rule.
2. Port Configuration Details
•
7880/TCP is the LiveKit API and WebSocket backend port. It should be accessed only through Caddy or a trusted private network.•
7881/TCP provides WebRTC over TCP and cannot be replaced by a standard HTTP reverse proxy.•
50000-60000/UDP is the default ICE/UDP media port range. Each participant consumes media ports.• You can use
rtc.udp_port: 7882 to multiplex ICE/UDP traffic through a single port. When enabled, the media port range is no longer used. Load-test at the target concurrency before changing this setting.•
3478/UDP is used by the optional built-in TURN/UDP service and also provides STUN.• Caddy handles only the HTTP API and WebSocket signaling. It does not proxy RTC UDP, ICE/TCP, or TURN traffic.
If the server is behind NAT, configure the cloud security group and host firewall, and map the RTC/TURN ports above accurately to the LiveKit server.