# Ports to open on an SFU node

| Port range | Proto | Source | Purpose |
|---|---|---|---|
| 40000–49999 | UDP + TCP | 0.0.0.0/0 | WebRTC media (mediasoup `rtcMinPort`–`rtcMaxPort`) |
| 5000 | TCP | signaling subnet only | Internal control API |
| 50000–59999 | UDP | 127.0.0.1 only | Recorder RTP → ffmpeg (loopback; never expose) |

Two failure modes that cost days if you get them wrong:

1. **`ANNOUNCED_IP` not set to the public IP.** On any NAT'd cloud VM, mediasoup advertises the private address, ICE never completes, and every call fails with no useful error. This is the single most common mediasoup deployment mistake.

2. **UDP not open.** Calls will still connect over TCP and appear to work in testing, then perform badly under real load. Always verify UDP candidates are being used.

Sizing note: one SFU node handles roughly 1,500 consumers. A 4-person call is 12 consumers. Plan capacity in consumers, not calls.