Firewall & Ports¶

This page lists every port Meet needs and gives ready-to-use firewall rules for each configuration.

Which ports does Meet need?¶

Meet has two categories of traffic:

Web traffic - handled entirely by your reverse proxy. These ports are always required regardless of LiveKit configuration:

LiveKit media - WebRTC audio and video go directly between participants and the LiveKit server, bypassing the reverse proxy. The ports you need depend on your LiveKit UDP strategy and whether you use TURN.

Configuration A: Single UDP port (default)¶

The standard Docker Compose setup. Open three ports total beyond 80/443:

7882/UDP is the critical port. If it is blocked, participants connect to the room but have no audio or video and fall back to TCP (7881), which increases latency.

Configuration B: UDP port range¶

If you use port_range_start/port_range_end in livekit-server.yaml instead of a fixed udp_port:

Replace 50000–60000 with whatever range you configured.

Configuration C: TURN on 443/UDP¶

When TURN is enabled, media is relayed through port 443/UDP. This replaces the direct media ports for participants who would otherwise be blocked:

Port 443/TCP and 443/UDP are independent sockets on Linux. Your reverse proxy holds 443/TCP; LiveKit holds 443/UDP. They do not conflict.

Configuration D: TURN over TLS on 5349¶

If you additionally enable TURN over TLS for participants who block all UDP:

Add this on top of Configuration C.

Ports that must NOT be exposed publicly¶

Firewall rules¶

Cloud provider security groups (AWS, Hetzner, OVH, etc.)¶

The exact UI varies by provider, but the rule pattern is the same. For Configuration A (single UDP port, no TURN):

For Configuration C (TURN on 443/UDP):

For Configuration D (TURN over TLS, add to C):

Linux - ufw¶

First check whether ufw is active:

sudo ufw status

If it is inactive, the OS firewall is not blocking anything and only your cloud provider's security group rules matter. If it is active, add rules to match your configuration.

Configuration A (single UDP port, no TURN):

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 7881/tcp
sudo ufw allow 7882/udp
sudo ufw reload

Configuration B (port range):

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 7881/tcp
sudo ufw allow 50000:60000/udp
sudo ufw reload

Configuration C (add TURN):

sudo ufw allow 443/udp
sudo ufw reload

Configuration D (add TURN/TLS):

sudo ufw allow 5349/tcp
sudo ufw reload

Linux - firewalld¶

For Fedora, RHEL, Rocky, AlmaLinux:

# Configuration A
sudo firewall-cmd --zone=public --permanent --add-port=80/tcp
sudo firewall-cmd --zone=public --permanent --add-port=443/tcp
sudo firewall-cmd --zone=public --permanent --add-port=7881/tcp
sudo firewall-cmd --zone=public --permanent --add-port=7882/udp
sudo firewall-cmd --reload

# Add for TURN (Configuration C)
sudo firewall-cmd --zone=public --permanent --add-port=443/udp
sudo firewall-cmd --reload

# Add for TURN/TLS (Configuration D)
sudo firewall-cmd --zone=public --permanent --add-port=5349/tcp
sudo firewall-cmd --reload

Verifying ports are open¶

From another machine, test that the ports are reachable:

# Test TCP ports (nc exits immediately on success)
nc -zv your-server.example.com 443
nc -zv your-server.example.com 7881

# Test UDP reachability (sends one packet, listens briefly)
nc -zuv your-server.example.com 7882

From inside the server, confirm LiveKit is listening:

# Show all listening ports for the livekit process
ss -tulpn | grep livekit

Expected output for Configuration A:

udp   UNCONN  livekit  *:7882   *:*
tcp   LISTEN  livekit  *:7881   *:*
tcp   LISTEN  livekit  *:7880   *:*

Telephony (SIP) - additional ports¶

If you enable telephony, two additional port ranges must be open:

These are only needed if you run the livekit-sip service.