Port 3478 (STUN / TURN): Uses and Security

What uses port 3478

Video calls in browsers (WebRTC), Zoom-like apps and SIP phones use STUN on 3478 to discover their public address behind NAT. When a direct connection is impossible, a TURN server relays the media, also on 3478, or on 5349 and 443 with TLS. coturn is the usual self-hosted server.

Should port 3478 be open to the internet?

Meant to be public. This port is meant to be reachable by clients on the internet when you run this service publicly.

TURN servers relay real traffic, so require credentials (time-limited REST credentials are common) and block relaying to private address ranges.

Check what is listening on port 3478

Linux

sudo ss -ltnp 'sport = :3478'
sudo ss -lunp 'sport = :3478'

macOS

sudo lsof -nP -iTCP:3478 -sTCP:LISTEN
sudo lsof -nP -iUDP:3478

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 3478 -State Listen
Get-NetUDPEndpoint -LocalPort 3478
netstat -ano | findstr :3478

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 3478

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

macOS / Linux

sudo kill $(sudo lsof -t -iTCP:3478 -sTCP:LISTEN)

Windows (PowerShell)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 3478 -State Listen).OwningProcess

Open port 3478 in the firewall

Ubuntu / Debian (ufw)

sudo ufw allow 3478/udp
sudo ufw allow 3478/tcp
# Close it again:
sudo ufw delete allow 3478/udp

RHEL / Fedora / Rocky (firewalld)

sudo firewall-cmd --permanent --add-port=3478/udp
sudo firewall-cmd --permanent --add-port=3478/tcp
sudo firewall-cmd --reload

Windows (PowerShell, as administrator)

New-NetFirewallRule -DisplayName "STUN / TURN 3478/UDP" -Direction Inbound -Protocol UDP -LocalPort 3478 -Action Allow
New-NetFirewallRule -DisplayName "STUN / TURN 3478/TCP" -Direction Inbound -Protocol TCP -LocalPort 3478 -Action Allow

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 3478 from another machine

macOS / Linux

nc -zv example.com 3478

Windows (PowerShell)

Test-NetConnection example.com -Port 3478

Related ports

Port 5060 (SIP): used by SIP for setting up VoIP calls.
Port 443 (HTTPS): the default port for HTTPS, encrypted web traffic.

More network services ports

53 (DNS) , 67 (DHCP server) , 68 (DHCP client) , 88 (Kerberos) , 123 (NTP) , 135 (Microsoft RPC) , 137 (NetBIOS Name Service) , 179 (BGP) . See all ports in the port lookup.

Sources

IANA port registry: 3478

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 3478 used for?

Port 3478 is used by STUN and TURN servers for WebRTC and VoIP NAT traversal. Video calls in browsers (WebRTC), Zoom-like apps and SIP phones use STUN on 3478 to discover their public address behind NAT. When a direct connection is impossible, a TURN server relays the media, also on 3478, or on 5349 and 443 with TLS. coturn is the usual self-hosted server.

Is it safe to open port 3478?

This port is meant to be reachable by clients on the internet when you run this service publicly. Keep the service behind it up to date and require authentication where it applies.

How do I check if port 3478 is open?

On the server, list listening sockets with "sudo ss -ltnp 'sport = :3478'" on Linux or "sudo lsof -nP -i :3478" on macOS. From another machine, run "nc -zv host 3478" or, on Windows, "Test-NetConnection host -Port 3478". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.