Skip to content
ProtocolPorts

Port reference

Port 3478 (UDP/TCP) – STUN / TURN

STUN/TURN — NAT traversal for WebRTC and VoIP; STUN discovers public addresses, TURN relays media.

udptcpRegistered

Quick facts

Transport
udp, tcp
Category
Registered
Risk level
High

Frequently targeted — restrict exposure and harden it.

Default state

Open on STUN/TURN servers (coturn, WebRTC, VoIP) facilitating peer connectivity, sometimes as an unauthenticated open relay.

What is port 3478 used for?

Port 3478 is the default for STUN and TURN, the NAT-traversal protocols that help WebRTC and VoIP apps connect. STUN lets a device discover its own public IP and port so two peers can talk directly; when that fails, TURN relays the audio, video, or data through a server. It's used by video-calling and conferencing tools (Jitsi, Discord, browser WebRTC apps) and TURN servers like coturn.

When would you open it?

Open or forward port 3478 if you run your own STUN/TURN server — for example a self-hosted coturn behind a video chat, conferencing, or VoIP service — so remote users behind NAT can connect. Regular client apps don't need it opened inbound.

Is it safe to open?

An unauthenticated TURN server can be abused as an open relay or in amplification DDoS attacks, so require long-term credentials, block relaying to private IPs, and prefer TURN over TLS on port 5349. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :3478
nmap -p 3478 <target>
Windows
netstat -ano | findstr :3478
Test-NetConnection <host> -Port 3478
macOS
lsof -i :3478
nmap -p 3478 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 3478 to your device's local IP, internal port 3478, protocol TCP/UDP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 3478/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=3478/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 3478 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 3478" -Direction Inbound -Protocol TCP -LocalPort 3478 -Action Allow

Security & risks

Common attacks

  • Open-relay abuse to proxy or anonymize traffic
  • UDP reflection/amplification DDoS via STUN responses
  • Credential brute force against TURN long-term auth
  • Internal network probing through misconfigured TURN

Hardening

  • Require authentication on TURN (long-term credentials)
  • Disable open relaying and restrict relay peer ranges
  • Rate-limit and filter to curb amplification abuse
  • Block TURN relays to internal/private IP ranges
  • Keep coturn patched and prefer TURN over TLS (5349)

How to block this port

Linux (ufw)
sudo ufw deny 3478/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=3478/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 3478 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 3478" -Direction Inbound -Protocol TCP -LocalPort 3478 -Action Block

nmap snippet

nmap -sU -p3478 --script stun-info,stun-version <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 5349Port 19302Port 5060Port 16384

Frequently asked questions

What is the difference between STUN and TURN?
STUN helps a peer discover its public IP/port for direct connection. TURN relays the media through the server when direct connectivity fails. TURN must be authenticated to avoid open-relay abuse.
Can port 3478 be used for DDoS?
Yes. STUN binding responses can be larger than requests, so a spoofed-source request makes the server reflect amplified traffic at a victim. Rate limiting and filtering reduce this risk.

Related guides