Ports & Firewall

Before exposing Monibuca across the public internet or NAT, confirm listen addresses and allow the matching inbound traffic. Values below are defaults or documented recommendations; your config.yaml always wins.

Port matrix

Service	Default / typical port	Protocol	Direction	Notes
HTTP API / Admin / FLV / HLS / WHIP·WHEP signaling	8180	TCP	inbound	`global.http.listenaddr` (see Quick Start); FLV, HLS, and WebRTC signaling share this HTTP port
HTTPS (optional)	`listen_addr_tls`	TCP	inbound	Requires certificates; Docker examples often map `8443`
gRPC	50051	TCP	inbound	`global.tcp.listenaddr` (not the cluster HTTP control plane)
RTMP	1935	TCP	inbound	`rtmp.tcp.listenaddr`
RTSP	8554	TCP	inbound	YAML default `:554` is remapped at runtime to 8554 (non-privileged); you can set `:8554` explicitly
RTSP RTP/RTCP (UDP mode)	10000–20000	UDP	inbound	`rtsp.udp_port_min` / `udp_port_max` when `enable_udp: true`
SRT	6000	UDP	inbound	`srt.listen_addr`
WebRTC ICE media	9000–9100 (UDP); dual ICE also 9101–9200 (TCP)	UDP / TCP	inbound	`webrtc.port_range` default `udp:9000-9100`; dual example `udp:9000-9100,tcp:9101-9200` (matches `deploy/compose`) — see WebRTC
QUIC cluster media relay	8002	UDP	inbound	`global.quic.listenaddr` / cluster `DEFAULT_QUIC_PORT`; only when cluster is enabled
TURN (coturn sidecar)	3478 / 5349; relay pool example 49160–49200 (UDP)	UDP/TCP	inbound	External process (not embedded); open the same relay span as coturn `min-port`/`max-port` — see WebRTC · TURN / coturn

NAT and WebRTC

Behind NAT: set webrtc.public_ip to a reachable address and configure ice_servers (STUN/TURN) as needed.
With dual ICE (port_range: "udp:A-B,tcp:C-D"), open both the UDP and TCP ranges.
For symmetric NAT or blocked UDP, run coturn alongside Monibuca and configure the same TURN iceServers on the server and in the browser client.

Minimal allowlist (single-node live)

Common starter set for a lab or same-datacenter host:

8180/tcp   HTTP / playback / signaling
1935/tcp   RTMP publish
8554/tcp   RTSP (optional)
6000/udp   SRT (optional)
9000-9100/udp   WebRTC media (optional)

See Quick Start for Docker port maps. For a ready Monibuca + coturn sidecar stack, use the repo reference deploy/compose/ (docker compose up; set PUBLIC_IP in .env; browsers must use the host public/LAN IP for TURN, not the Docker service name). Dual ICE and TURN details: WebRTC.