Firewall & Networking
Which ports to open and how to handle NAT and reverse proxies.
Required ports
| Port | Protocol | Direction | Purpose |
|---|---|---|---|
| 22 | TCP | Inbound | SSH (server management) |
| 80 | TCP | Inbound | HTTP (SSL cert auto-renewal) |
| 443 | TCP | Inbound | HTTPS (if using a reverse proxy) |
| 5000 | TCP | Inbound | Realm HTTP API + WebSocket |
| 40000-49999 | UDP | Inbound | Voice (WebRTC/RTP media) |
Outbound: Allow all. The server needs to reach the Realm API, its database, DNS, Docker Hub, and NTP.
Voice requires UDP. Without ports 40000-49999 open, text chat and
signaling will work but voice will be broken. ICE state stays new and 0
bytes flow. There is no software workaround.
Hetzner Cloud
Go to the Hetzner Cloud Console, then Firewalls and Create Firewall.
Inbound rules:
| Source | Protocol | Port |
|---|---|---|
| Any IPv4/6 | TCP | 22 |
| Any IPv4/6 | TCP | 80 |
| Any IPv4/6 | TCP | 443 |
| Any IPv4/6 | TCP | 5000 |
| Any IPv4/6 | UDP | 40000-49999 |
Outbound rules: Leave as default (allow all).
After creating the firewall, attach it to your server under Servers > select your server > Firewalls.
DigitalOcean
Go to the DO Console, then Networking > Firewalls > Create Firewall.
Inbound rules:
| Type | Protocol | Port Range | Sources |
|---|---|---|---|
| SSH | TCP | 22 | All IPv4/6 |
| HTTP | TCP | 80 | All IPv4/6 |
| HTTPS | TCP | 443 | All IPv4/6 |
| Custom | TCP | 5000 | All IPv4/6 |
| Custom | UDP | 40000-49999 | All IPv4/6 |
Outbound rules: Allow all (default).
Apply the firewall to your Droplet after creating it.
AWS EC2
In the EC2 Console, edit the Security Group inbound rules for your instance:
| Type | Protocol | Port Range | Source |
|---|---|---|---|
| SSH | TCP | 22 | Your IP |
| HTTP | TCP | 80 | 0.0.0.0/0 |
| HTTPS | TCP | 443 | 0.0.0.0/0 |
| Custom TCP | TCP | 5000 | 0.0.0.0/0 |
| Custom UDP | UDP | 40000-49999 | 0.0.0.0/0 |
UFW (Ubuntu)
If your VPS uses UFW instead of a cloud firewall:
ufw allow 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw allow 5000/tcp
ufw allow 40000:49999/udp
ufw enable
ufw statusNAT and reverse proxies
If your server is behind NAT or a reverse proxy, set REALM_WEBRTC_ANNOUNCED_IP to your public IP or hostname. Without this, the voice server will advertise the wrong address in ICE candidates and voice will fail.
# Public IP
REALM_WEBRTC_ANNOUNCED_IP="203.0.113.42"
# Or a domain name (resolved automatically)
REALM_WEBRTC_ANNOUNCED_IP="my-server.example.com"If clients connect on a port other than 5000 (e.g. via an HTTPS reverse proxy on 443):
REALM_IDENTITY_PUBLIC_HOST="my-server.example.com"
REALM_IDENTITY_PUBLIC_PORT=443Caddy only proxies HTTP/WebSocket traffic. The UDP voice ports (40000-49999) must be exposed directly on the host. There is no way to tunnel UDP voice traffic through an HTTP reverse proxy.