Managing Firewall Rules for RTMP Streaming
Firewall rules are essential on any Ubuntu streaming server. A streaming server needs to be reachable, but it should not expose unnecessary services to the public internet. The aim is simple: allow what your stream needs, block what it does not.
Step 1: Check whether UFW is installed and active:
sudo ufw status
Step 2: Allow SSH before enabling the firewall, otherwise you may lock yourself out:
sudo ufw allow OpenSSH
Step 3: Allow RTMP ingest:
sudo ufw allow 1935/tcp
Step 4: Allow HTTP and HTTPS if you serve HLS or a web player:
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
Step 5: Enable the firewall:
sudo ufw enable
Step 6: Review the final rules:
sudo ufw status numbered
Step 7: If possible, restrict publishing access. For example, if only your studio has a fixed IP address, allow port 1935 only from that IP and block everyone else.
Step 8: Keep admin panels, databases and internal services closed to the public.
Step 9: Recheck firewall rules after server migrations or IP changes.
A common beginner mistake is opening too much “just to make it work.” That may solve a connection issue quickly, but it can create long-term security problems. Start with SSH, RTMP, HTTP and HTTPS only. If a feature needs another port, document why it is open and who should access it. Clean firewall rules make the server safer and much easier to troubleshoot later.
Hosting tip: For Online Audience style hosting guides, remind users to test changes outside busy broadcast times, keep a backup of the last working configuration, and avoid exposing admin services publicly. A clear checklist, sensible firewall rules and careful bitrate choices will prevent most support issues before they happen.