What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For a basic SRS-to-YouTube relay, allow only the inbound publishing service you need—typically TCP 1935 for RTMP—and permit SRS to make an outbound connection to the RTMPS URL and port shown in YouTube Live Control Room. Keep the SRS API, playback, and WebRTC services closed to the public unless your setup actually uses them. The right rules depend on your SRS version, configuration, and whether publishers or viewers connect to the server.
Plan the traffic before opening ports
Think of the setup as separate connections, not one generic “streaming port”: an encoder publishes to SRS, SRS sends the feed to YouTube, and—if you choose—viewers may also consume playback from SRS. Each path can use a different protocol and direction through the firewall.
- Inbound publishing: Your encoder or other source connects to an SRS listener.
- Outbound delivery: SRS connects to the RTMPS endpoint YouTube displays for your stream.
- Optional viewer access: Viewers connect to SRS only if you serve playback there; it is not needed just to relay a feed to YouTube.
- Optional WebRTC: WebRTC has separate signaling and media paths, so it needs its own rules.
SRS’s documented port list describes available services; it is not an instruction to expose every port. The versioned SRS v7 and v8 documentation labels those versions unstable, so confirm the running release’s configuration and actual listeners before applying rules.
Which SRS ports should the firewall allow?
SRS documents these common ports and services. Actual ports can vary with configuration; use this as an inventory to check, not a blanket allowlist.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
| Port and transport | Documented purpose | Firewall treatment for a basic YouTube relay |
|---|---|---|
| TCP 1935 | RTMP | Allow inbound only if RTMP publishing is enabled. Restrict source addresses to known encoders or a private network/VPN where practical. |
| TCP 1985 | HTTP API and WebRTC-related services | Keep inaccessible from the public internet unless the intended service requires it; restrict access to its clients. |
| TCP 8080 | HTTP streaming, including HTTP-FLV/HLS-style playback | Leave closed if viewers do not consume playback from SRS. If needed, expose only through the chosen web/TLS and access-control design. |
| UDP 8000 | WebRTC media default | Leave closed for an RTMP-only relay. If using WebRTC, match the active media and candidate configuration. |
| TCP 8088 | Optional HTTPS service | Open only if your configuration uses it and the intended clients require it. |
SRS also documents optional converter and signaling ports. Check the documentation and configuration for your exact release and enabled services before permitting them. For administration, use a trusted management route such as a restricted private network or VPN; do not expose a streaming listener as a management path.
Set firewall rules for RTMP ingest and RTMPS delivery
1. Permit the intended encoder to reach SRS
If RTMP publishing is enabled, TCP 1935 is the usual inbound listener to consider. In the host firewall and any cloud network firewall or security group, allow that port only from the encoder’s known public address, private subnet, or VPN where your network design permits. If publishers have changing addresses, decide how they will reach the service securely rather than opening the listener to everyone by default.
Confirm the SRS listener is actually enabled and bound to the address and port you intend to use. If SRS runs in a container or behind network address translation, the host or cloud rule, port mapping, and SRS listener must agree.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
2. Allow SRS to reach YouTube’s current RTMPS endpoint
In YouTube Live Control Room, reveal the RTMPS URL in the stream settings and use that actual URL in the software or relay configuration handling the upstream connection. YouTube recommends RTMPS. Its troubleshooting guidance says to check that the URL uses the rtmps scheme and to try specifying port 443 when needed.
Free tools Windows power users keep installed
One-click scans. No signup required.
Permit the SRS host to make outbound connections to the displayed endpoint and port under your organization’s egress policy. Do not substitute a remembered sample hostname for the URL shown in Live Control Room; the destination should come from the current stream settings. RTMPS protects the YouTube-facing connection in transit, but it does not secure the host, an exposed SRS API, or other unencrypted paths.
3. Keep unused services closed
For the basic RTMP-ingest-to-YouTube design, do not open TCP 1985, TCP 8080, UDP 8000, or optional service ports to the public merely because SRS supports them. If your deployment needs an API, playback, or another service, allow only the clients that need it and apply the appropriate authentication, TLS, or proxy controls for that service.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
When your SRS edge uses RTMPS
SRS v7 documentation describes RTMPS support using TLS certificates and a separate RTMPS listener configuration. Its example configuration shows port 1443 as an example listener value. That is distinct from YouTube’s suggestion to try outbound port 443: the first is a possible publisher-to-SRS inbound listener, while the second concerns SRS-to-YouTube egress. Configure and document the listener you actually use, and allow only that inbound port from intended publishers.
If you enable WebRTC
Do not reuse the RTMP-only plan unchanged. SRS documents WebRTC signaling and media as separate paths, with UDP 8000 as the media default. TCP transport can be enabled where UDP is unavailable, but the actual listener and candidate settings depend on your configuration.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- Identify the signaling service and its configured listener.
- Check the candidate address advertised to the WebRTC client; it must be reachable from that client’s network.
- Allow the configured media transport and port through host and cloud firewalls. If using TCP instead of UDP, confirm the configured TCP listener and candidate.
- Limit access to intended clients where possible; do not assume that opening TCP 1935 will make WebRTC work.
If viewers need playback from SRS
A public playback endpoint is not required for a stream that is only relayed to YouTube. If viewers should receive HLS or HTTP-FLV directly from SRS, make the relevant HTTP or HTTPS listener reachable to those viewers through your chosen TLS and edge-proxy design. SRS documents TCP 8080 for HTTP streaming and optional TCP 8088 for HTTPS; open only the configured service that your playback design needs.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Protect the YouTube stream key
YouTube describes stream keys as being like a stream’s password and address. Treat the key as a credential: do not put it in public configuration examples, screenshots, source control, or support requests, and restrict access to files or services that store it. A firewall allowlist does not protect a key that has been exposed. If it is compromised, an owner or manager can reset it from Live Control Room.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Apply and verify the rules
- Record the intended paths. Note the publisher’s source network, SRS listener and protocol, YouTube RTMPS URL and port, and any viewer or WebRTC paths you need.
- Review active SRS services. Check the configuration and listeners for your installed version. Disable services you do not need, then match the host firewall and any cloud firewall rules to the remaining paths.
- Apply inbound restrictions. Permit only the necessary publishing listener from intended sources. Add API, playback, or WebRTC access only for their intended clients.
- Apply outbound policy. Allow the SRS host to reach the RTMPS endpoint and port displayed in Live Control Room.
- Validate each connection separately. Confirm the encoder can publish to SRS, SRS can deliver to YouTube, and any intended viewer can reach playback. If WebRTC is enabled, check signaling and media independently.
- Recheck after changes. Review rules after SRS upgrades, configuration changes, network migrations, or changes to the YouTube stream settings.
Troubleshooting common firewall symptoms
The encoder cannot connect to SRS
- Confirm RTMP or RTMPS publishing is enabled and that the configured listener matches the firewall rule.
- Check the listener’s bind address, container port mapping, and any cloud security rule as well as the host firewall.
- Confirm the publisher’s current source address is permitted and that it can reach the configured port.
SRS cannot connect to YouTube
- Copy the current RTMPS URL from Live Control Room rather than relying on a static example.
- Check that the URL uses
rtmps, that outbound access to its destination port is permitted, and that the upstream software supports TLS. - If the connection’s TLS or port setup is failing, YouTube’s troubleshooting guidance says to try specifying port 443 where needed.
RTMP works, but WebRTC does not
- Check the separate signaling and media paths, the configured candidate address, and whether the required UDP or configured TCP traffic is blocked.
- Verify that the candidate address is reachable from the client’s network; opening the RTMP listener alone is insufficient.
An unexpected API or playback service is publicly reachable
Compare active listeners with the SRS service inventory and inspect both host-level and cloud-level rules. Disable the service if it is unnecessary; otherwise restrict its reachable clients and apply the appropriate access and TLS controls.
An unauthorized stream appears or the key may have leaked
Reset the compromised key in Live Control Room and review who or what can access the configuration where it is stored.
Recommended Free Tools
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Or let it run in the cloud
If your goal is simply to keep uploaded videos live on a YouTube channel, StreamNeo is a different option from administering an SRS relay: upload a recording or build a playlist, add your YouTube stream key once, and go live. It loops the uploaded video from the cloud, so no computer or home connection has to stay on. It is YouTube-only and does not go live from a camera.
- Nothing has to stay on at home.
- Videos stream as uploaded, up to 4K 60fps, at one flat price per slot.
- Automatic recovery if YouTube drops the stream.
- The first day is free with no card; one free day per account.
The monthly option is $9.99 per month. See StreamNeo or its pricing page, then start the free day.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
