Port 3478 STUN / TURN · TCP and UDP

What runs on port 3478

STUN and TURN: NAT traversal for WebRTC, VoIP and video calls. STUN tells a client its public address and port; TURN relays media when a direct path is impossible. 3478 is the plain port, 5349 is TURN over TLS, and relays allocate media on a configurable UDP range (49152–65535 by default in coturn). Every self-hosted video-conferencing or Nextcloud Talk setup needs this open.

Software that uses it: coturn · Jitsi Meet · Nextcloud Talk · Matrix/Element calls · BigBlueButton · Google/Twilio STUN servers

Should port 3478 be open?

Designed to face the internet. This port exists to be reachable from anywhere, so the usual question is not whether to open it but how the service behind it is configured and patched.

• Open UDP 3478 plus the relay range; TCP 3478/5349 for clients behind UDP-blocking firewalls.
• A TURN server without authentication becomes a free relay for others; use long-term credentials or REST-API time-limited ones.

Check port 3478

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :3478'
ss -lunp 'sport = :3478'
sudo lsof -i :3478

# from another machine: is it reachable?
nc -zv host 3478
nmap -p 3478 host
nc -zuv host 3478
sudo nmap -sU -p 3478 host
curl -v telnet://host:3478      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 3478

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 3478 proto tcp
sudo ufw allow from 10.0.0.0/8 to any port 3478 proto udp
sudo ufw deny 3478/tcp
sudo ufw deny 3478/udp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 meta l4proto { tcp, udp } th dport 3478 accept
nft add rule inet filter input meta l4proto { tcp, udp } th dport 3478 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 3478 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 3478 -j DROP
iptables -A INPUT -p udp --dport 3478 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 3478 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=3478 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 3478" with no source is just "open".

Related ports

• 5060 SIP — VoIP signalling
• 5061 SIP over TLS
• 10000 Webmin

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions