Quick reference
Client access (required)
Open to: the networks of all users of the apps, desktop clients, web, and Mini Programs.- The web client uses only 443 and 39001/UDP; native clients need all three
- Clients connect only to these three ports. If you change 443 or 18883, also update the access addresses under System configuration → Network in the admin console
- 80/TCP doesn’t need to be open externally
Device gateway
Needed only when connecting hardware devices. Open to the subnets where the devices are, not the internet.
When there’s NAT between devices and the device gateway:
- At deployment, set the “device access gateway IP” to the address the devices see (the post-NAT address)
- Port mappings on the NAT must keep the same port numbers, especially for the RTP port range; otherwise calls connect but have no audio or video
Between servers
In a single-server deployment, services talk over loopback, so nothing extra needs to be opened. In split-server or multi-node deployments, open the following on the internal network between servers:MCU live streaming (optional, off by default)
Needed only when using the MCU’s built-in live streaming:
These ports have no encryption or authentication. For public audiences, we recommend reverse proxying them through 443 instead of exposing them directly.
Never expose externally
The following ports are used only on the server itself or the internal network. Don’t open them to the internet:Outbound connections from servers
On internal-only networks, the following features need outbound access from the server:Firewall configuration examples
Minimal set (firewalld):ufw allow 443/tcp, ufw allow 39001/udp, and so on.