Ports & Firewall

Before exposing Monibuca across the public internet or NAT, confirm listen addresses and allow the matching inbound traffic. Values below are defaults or documented recommendations; your config.yaml always wins.

Port matrix

Service	Default / typical port	Protocol	Direction	Notes
HTTP API / Admin / config UI	8180	TCP	inbound	global.http.listenaddr — APIs, admin (unless admin.listen_addr split), config UI
Media HTTP (optional)	per-plugin http.listenaddr	TCP	inbound	Shared media listener for FLV/HLS/WebRTC/MP4 play paths when set (e.g. :8081); deduped per unique address
Media HTTPS (optional)	per-plugin http.listen_addr_tls	TCP	inbound	TLS play + WS (wss://) on media port; cert_file/key_file inherit from global when unset
HTTPS (optional)	listen_addr_tls	TCP	inbound	Global control-plane HTTPS; requires certificates; Docker examples often map 8443
gRPC	50051	TCP	inbound	global.tcp.listenaddr (not the cluster HTTP control plane)
RTMP	1935	TCP	inbound	rtmp.tcp.listenaddr
RTSP	8554	TCP	inbound	YAML default :554 is remapped at runtime to 8554 (non-privileged); you can set :8554 explicitly
RTSP RTP/RTCP (UDP mode)	10000–20000	UDP	inbound	rtsp.udp_port_min / udp_port_max when enable_udp: true
SRT	6000	UDP	inbound	srt.listen_addr
WebRTC ICE media	9000–9100 (UDP); dual ICE also 9101–9200 (TCP)	UDP / TCP	inbound	webrtc.port_range default udp:9000-9100; dual example udp:9000-9100,tcp:9101-9200 (matches deploy/compose) — see WebRTC
QUIC cluster media relay	8002	UDP	inbound	global.quic.listenaddr / cluster DEFAULT_QUIC_PORT; only when cluster is enabled
TURN (coturn sidecar)	3478 / 5349; relay pool example 49160–49200 (UDP)	UDP/TCP	inbound	External process (not embedded); open the same relay span as coturn min-port/max-port — see WebRTC · TURN / coturn

NAT and WebRTC

• Behind NAT: set webrtc.public_ip to a reachable address and configure ice_servers (STUN/TURN) as needed.
• With dual ICE (port_range: "udp:A-B,tcp:C-D"), open both the UDP and TCP ranges.
• For symmetric NAT or blocked UDP, run coturn alongside Monibuca and configure the same TURN iceServers on the server and in the browser client.

Minimal allowlist (single-node live)

Common starter set for a lab or same-datacenter host:

8180/tcp   HTTP API / admin / config
8081/tcp   Media HTTP playback (optional; set flv/hls `http.listenaddr`)
8443/tcp   Media or global HTTPS (optional)
1935/tcp   RTMP publish
8554/tcp   RTSP (optional)
6000/udp   SRT (optional)
9000-9100/udp   WebRTC media (optional)

See Quick Start for Docker port maps. For a ready Monibuca + coturn sidecar stack, use the repo reference deploy/compose/ (docker compose up; set PUBLIC_IP in .env; browsers must use the host public/LAN IP for TURN, not the Docker service name). Dual ICE and TURN details: WebRTC.