The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →For a basic SRS-to-YouTube relay, expose only the SRS ingest listener that your encoder needs, restrict who can reach it when practical, and allow SRS to make an outbound RTMPS connection to the URL shown in YouTube Live Control Room. Do not open every port in SRS’s service list: API, playback, and WebRTC ports are needed only when you use those services. Exact rules depend on your SRS version, configuration, and network layout.
Understand the traffic before changing firewall rules
A relay has at least two distinct connections: your encoder publishes to SRS, then SRS sends the feed to YouTube. Rules for the first connection are inbound to the SRS host; rules for the second are outbound from it. If viewers also watch from SRS, or if you use WebRTC, those add separate paths.
- Encoder to SRS: inbound to the SRS listener, typically TCP 1935 for RTMP when enabled.
- SRS to YouTube: outbound to the RTMPS URL and port supplied in Live Control Room.
- Optional SRS services: HTTP API, HTTP playback, HTTPS, and WebRTC each have their own listener or transport requirements.
SRS’s port inventory describes services it can provide; it is not a firewall allowlist. The SRS v8 resource and WebRTC documentation and v7 RTMP documentation label those pages unstable, so check the documentation and active configuration for the release you actually run before relying on defaults. SRS resource ports · SRS WebRTC · SRS RTMP
Choose the minimum firewall policy for your setup
Basic RTMP ingest to YouTube
- Allow inbound TCP 1935 only if RTMP publishing is enabled. If the encoder has a stable public address, limit the rule to that address. Otherwise, consider a private network or VPN for publishers. TCP 1935 is SRS’s documented RTMP service port; source restriction is least-privilege guidance, not a claim about an SRS default.
- Allow outbound access from SRS to YouTube’s current RTMPS endpoint. Copy the URL and port shown in YouTube Live Control Room. Google’s troubleshooting guidance says to verify the
rtmpsscheme and try port 443 if needed; do not substitute a static sample hostname for the URL shown for your stream. - Keep unrelated listeners closed from the public internet. Unless your design requires them, do not expose TCP 1985 (HTTP API), TCP 8080 (HTTP streaming such as HTTP-FLV/HLS), or UDP 8000 (WebRTC media). Disable unused services where possible, and restrict any service you do need to its intended clients.
- Manage the host through a separate trusted route. Use a restricted management network or VPN rather than treating a streaming listener as an administration path.
Apply the equivalent controls at each layer in your deployment: the host firewall, any cloud network firewall or security group, and container or router port mappings. A host rule cannot compensate for a broader upstream rule that still exposes an unused service.
Recommended Free Tools
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
If publishers connect to SRS using RTMPS
SRS v7 documentation describes RTMPS support using TLS certificates and a separately configured RTMPS listener. Its example configuration uses port 1443 as an example listener; that is not a required YouTube port. The publisher-to-SRS listener is inbound to your server, while SRS-to-YouTube RTMPS is outbound. Allow only the listener and port you actually configured. SRS RTMP and RTMPS configuration
If you use WebRTC
Do not apply the RTMP-only rules unchanged. SRS separates WebRTC signaling from media and documents UDP 8000 as the default media port. TCP media transport can be enabled where UDP is unavailable, but the actual listener and candidate address depend on your configuration. Permit only the signaling and media paths your deployment uses, and make sure the advertised candidate address is reachable by the intended clients. SRS WebRTC configuration
Rank #2
- 【Professional Firewall & NAS SERVER】OAKNODE 10gbe Firewall Appliance Mini PC-MGNASN, a powerful professional firewall router pc equipped with a 12th Gen Alder Lake N100 4C/4T up to 3.4GHz TDP only 6W with Intel UHD Graphics which maximizes the performance of the 2.5GbE port & SFP+ port, bring you a smooth secured and encrypted network environment.
- 【Rich I/O to meet your needs】Firewall Appliance MGNASN With HDMI 2.0+DP 1.4+TYPE-C(dp 1.2) Support for 3x4K@60Hz together, Dual DDR4 RAM slot support for up to 1x32GB SO-Dimm laptop DDR5 Ram Maximum 5600Mhz and 1xM.2 NVMe/PCIe 3.0x1 2280 SSD slot +1*SATA 3.0 SSD/HDD slots (install externally), also it support boot from TF card slot and it also support PXE/AWOL/Watchdog/GPIO etc. which is perfect for your firewall appliance、VM、Router、home Server needs.
- 【2xSFP+ 10GbE + 4x2.5GbE】This Firewall Router equipped with 2xIntel 82599ES 10gbe network card and 4*Intel i226-V network card speed maximum up to 2.5GbE(need other device like router, cables etc. also support 2.5Gbe/10gbe)which can bring you more faster and professional network usage(some system not release drivers yet) suggest to install version of below systems: pf-sense plus 23.0X or CE 2.7.X, OPNsense 22.1, OpenWrt, ROS7, ESXI 8 , Proxmox, CentOS etc).
- 【4G LTE Function supported】This model also support 4G LTE function(mini PCIE slot for 4G modem) and SIM card slot which you can use it as a IOT devices for your server.
- 【Quality With Warranty】If you have any questions or requirements(like OS installation/ drives/bios updates etc.) on OAKNODE Firewall mini pc MGNASN, PLEASE feel free to contact us. We offered 12 Months warranty for it and WE'LL REPLY YOUR Questions within 12 hours(during Workdays).
If viewers play streams from SRS
Make the relevant HTTP or HTTPS playback listener reachable only if viewers need to consume HLS or HTTP-FLV from SRS. SRS lists TCP 8080 for HTTP streaming and optional TCP 8088 for HTTPS service. Decide how TLS termination and any edge proxy or access controls fit your deployment; do not expose the API just because playback is public. SRS service ports
Get YouTube’s RTMPS destination and protect the stream key
- In YouTube Live Control Room, open the stream’s settings and reveal or select the RTMPS URL in Stream settings. The ordinary URL field may show RTMP by default.
- Use that exact URL, including its protocol and destination, in the component that sends the stream upstream to YouTube. YouTube recommends RTMPS for an encrypted connection; its troubleshooting guidance says to check for the
rtmpsscheme and try port 443 if necessary. YouTube encoder settings and troubleshooting · YouTube RTMPS recommendation - Store the YouTube stream key as a password. YouTube describes stream keys as like a stream’s password and address. Do not include one in screenshots, public configuration examples, support requests, source control, or broadly accessible logs. If exposed, reset it in Live Control Room; owner or manager access is required for the reset process. Manage live stream settings and stream keys
RTMPS encrypts the SRS-to-YouTube connection. It does not secure the SRS host, its management path, an exposed API, or other connections that use plaintext protocols.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- BUSINESS READY - pfSense+ software updates included for product lifetime. Netgate TAC Lite technical support included. One year hardware warranty included.
- COMPLETE - Pre-loaded with pfSense+ software to get up and running fast. Simply unbox it and start customizing for your secure edge networking needs. Free help with setup from our expert Technical Assistance Center (TAC) available 24/7/365.
- POWERFUL - A dual core ARM Cortex-A53 1.2 GHz delivers near gigabit routing of common home iPerf3 traffic and in excess of 650 Mbps of firewall throughput.
- COMPACT - Low power draw, a compact form factor, and silent operation allow it to run unnoticed when placed on a desktop, wall, or rack.
- FLEXIBLE - Three (3) 1 GbE switched (WAN/LAN/OPT) ports allow you to configure three separate 1 GbE switched ports for upto a gigabit of bi-directional traffic.
Verify the paths after applying the rules
Validate each connection that your design actually uses. A successful encoder connection alone does not prove that SRS can reach YouTube or that playback works for viewers.
- Publisher to SRS: confirm the configured SRS listener is enabled, the port matches the host and cloud firewall rules, and the encoder can reach it from its permitted source network.
- SRS to YouTube: confirm SRS or the upstream component has outbound access to the actual Live Control Room RTMPS URL and port, and that the connection uses RTMPS.
- Optional viewer or WebRTC path: test from the intended client network, not only from the server itself. Check the relevant HTTP/HTTPS listener or WebRTC signaling, media transport, and candidate address.
- Exposure review: compare active SRS services with host and cloud rules. Confirm that API and playback ports are not publicly reachable unless that is intentional.
Troubleshoot common firewall and connection failures
| Symptom | Likely checks and fixes |
|---|---|
| Encoder cannot connect to SRS | Confirm RTMP or RTMPS is enabled; verify the actual listener port and address; check container or router mappings as well as host and cloud firewall rules; confirm the publisher’s source address is allowed. SRS documents TCP 1935 as its usual RTMP service port, but a deployment may configure a different listener. |
| SRS cannot send the feed to YouTube | Copy the current URL from Live Control Room; confirm the URL uses rtmps; check outbound rules for the destination port. YouTube advises trying 443 if needed. Also verify that the software handling the upstream connection supports TLS. |
| WebRTC fails while RTMP works | RTMP and WebRTC use different paths. Check the configured candidate address, signaling reachability, and UDP media rules; if your configuration uses TCP media, check that listener instead. SRS identifies candidate and firewall/port restrictions as possible causes. |
| An unexpected stream appears or the YouTube key may be exposed | Reset the stream key through Live Control Room and review who can access the configuration, logs, or secret store that contained it. |
| The API or playback service is unexpectedly public | Review SRS’s active services and the host, cloud, and container rules. Disable services that are not needed or restrict them to their intended clients. |
When to use a managed host or a cloud relay
A self-managed SRS server gives you control over listeners and network policy, but you are responsible for keeping the host, firewall layers, credentials, and relay process configured. A managed VPS or cloud host may suit you if it provides the network controls your deployment needs; verify those controls and SRS compatibility with the provider rather than assuming they are universal.
Rank #4
- 【CPU】Intel Pentium J3710 4-Core/4-Thread processor, up to 2.64GHz, with 2MB L2 Cache and 6W TDP. Supports AES-NI and suitable for firewall, router, VPN and other network applications.
- 【Ports & Expansions】Equipped with 4 x 2.5GbE Intel i226-v LAN ports. Includes 2 x USB3.0, 1 x HDMI. 1 x VGA ports.Supports optional Wi-Fi and 3G/4G module expansion, plus a VESA mounting kit.
- 【Fanless & Low-Power Design】6W fanless design with an aluminum alloy chassis for quiet, low-maintenance operation. Design for 24/7 continuous use and suitable for home networks, small office and network labs.
- 【RAM & Storage】Includes 8G DDR3 RAM and a 128GB mSATA SSD. Supports up to 8GB RAM and 512GB mSATA storage. HDD storage is not supported. Compact 5.27 x 4.98 x 1.43-inch design weighs only apporximately 500g.
- 【Warranty & Support】Tested with pfSense, OPNsense, Ubuntu and other popular open-sourse OS. Supports Proxmox VE for virtualization and home lab applications. Includes a 12-month hardware warranty and lifetime technical support. (Press "DEL" to the BIOS)
Or let it run in the cloud
If your goal is simply to keep uploaded videos live on YouTube 24/7, StreamNeo is a separate cloud option rather than an SRS firewall configuration: upload a recording or build a playlist, add your YouTube stream key once, and go live. It loops uploaded videos from the cloud, so no computer or home connection has to stay on. StreamNeo supports uploaded quality up to 4K 60fps at one flat price per slot, can recover automatically if YouTube drops the stream, and offers the first day free with no card. Monthly is $9.99 per month. It streams to YouTube only and does not replace a camera-based live production workflow. Learn more at StreamNeo or start the free first day.
Quick Recap
Best Value
- 【CPU Optimized for Firewall Mini PCs】This firewall appliance is powered by Intel Quad-Core Celeron J1900, 64-bit, up to 2.0 GHz, supporting software-based encryption. Energy-efficient and reliable, it runs 24/7 for home or small office networks, handling VPNs, multi-WAN routing, and basic firewall tasks efficiently.
- 【4×Intel i210 Ports】Equipped with four Intel i210 network controllers, each delivering up to 1 GbE for reliable multi-WAN routing, VPN connections, VLAN management, and stable performance in small office or home firewall deployments
- 【Memory & Storage】This Firewall Mini PC comes with 4 GB DDR3L RAM and a 64 GB mSATA SSD, providing reliable performance for basic networking tasks. AMI BIOS with ACPI support ensures stable system operation and energy-efficient 24/7 use
- 【Flexible System Compatibility】Compatible with Windows 10, Linux, and professional firewall systems such as pfSense, OPNsense, and VyOS, ensuring stable network management for home or small office use
- 【After-Sales Support:】This compact, fanless, and silent firewall keeps your network secure. Includes lifetime technical support and a 30-day money-back guarantee!
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
