Can't connect to custom ports

Numbless · July 21, 2026, 12:07pm

A huge issue I came across when using NymVPN is that I cannot connect to non-standard ports. Whether I try to SSH (to a port different from 22), connect to a game server, or use any service where I need to connect to a server that listens on some random port, it just doesn’t work. Thanks for letting me use https, email and some other common protocols with common ports, that covers most of my needs, but I don’t need a VPN to function like a web proxy, it should cover all of my traffic. I used to use ProtonVPN, free tier, mind you, and didn’t have these issues.

code-zm · July 21, 2026, 2:01pm

Exit gateways in the mixnet function similar to Tor exit nodes. Traffic is allowed / denied based on an exit policy. The community can request any ports to be opened via Nym Improvement Proposals.

Here’s an example NIP: NIP-13: Nym Exit Policy Update – Opening Additional Ports for User Services

merve · July 21, 2026, 2:32pm

I’ve started putting together the list of ports needed for the next NIP. Feel free to add any ports you’d like us to include in the exit policy.

Numbless · July 21, 2026, 8:36pm

OK, so here’s the list off the top of my head:

Minecraft Bedrock (I don’t play it, but many do, so it’s worth adding): 19132, 19133

Luanti:

Choose a port to run the server on. The default of 30000 is recommended, and if you host several it is recommended to increment upwards. (e.g. 30001, 30002…)

Most servers abide by that rule, somewhat, so I’d recommend allowing ports 30000-30099. But there are some popular servers that don’t abide by it, so I’d also add these: 30420 (oysterity anarchy), 40001 (FFA Groundwars Evolve), 40002 (FFA Groundwars PVP), 56008 (Versus Town).

RustDesk: 21114-21119

Syncplay: 8999. Official servers (hosted on syncplay.pl) use ports 8995-8999, so it’s worth adding those too.

SSH is still an issue. I see that node exit policy allows “alternative” ports (2222, 223), but they are too common and easy to guess. Also, many game servers use custom ports (as can be seen from Minecraft and Luanti). So the only real way to fix this problem is to allow all ports (except the likes of Telnet, which are almost never used and can be abused, for example, for port scanning).

Numbless · July 22, 2026, 9:51am

Some rather minor additions:

nightfall.city: 1900

AnyDesk (this port is not essential because 80 and 443 are also sufficient, but I’ll list it just in case): 6568

Numbless · July 22, 2026, 10:00am

And a more important one:

SPICE: 1923

merve · July 22, 2026, 10:05am

noted! thanks

Numbless · July 22, 2026, 10:58am

Sorry for the barrage of replies.

I know some people who use Viber, so I think opening these ports would be beneficial: 4244, 5242, 5243, 7985

Source: https://help.viber.com/hc/en-us/articles/8805123374365-Open-ports-for-Viber-desktop

Same thing with WhatsApp VoIP: 3478, 4244, 5222-5228, 5242, 5349, 34784, 45395, 50318, 59234

Sources:

https://www.reddit.com/r/fortinet/comments/14kw3bf/comment/jpyodui/

merve · July 22, 2026, 11:18am

Thanks everyone for the port suggestions! I’ve double-checked everything against the current Nym exit policy (v1.10.0 - 24th June 2026). Here’s the accurate breakdown:

Already Open in Current Exit Policy (No Action Needed)

Service	Port(s)
SSH	22, 223, 2222
HTTP/HTTPS	80, 443, 8080
WhatsApp	3478-3484, 5222-5223, 5228, 5349
XMPP	5222-5223
IRC	6697
Syncplay	8995-8999
Minecraft	25565
Steam	27000-27050, 4379-4380
Discord	50000-65535

Not Currently Open - Will Be Added to NIP-14

Proxy: TCP 1080-2080, 8081-9080, 10000-10999
DarkIRC: TCP 9600
Minecraft Bedrock: UDP 19132, 19133
Minecraft Voice Chat: UDP 24454
Space Station 14: TCP/UDP 1212
Luanti: TCP/UDP 30000-30099, 30420, 40001, 40002, 56008
RustDesk: TCP/UDP 21114-21119
Syncplay: TCP 8996-8999 (8995 already open)
Star Wars: TOR: TCP 12000-12999, 20000-30000
Battlefield/EA: TCP 9988, 17502, 20000-20100, 22990, 42127 + UDP 3659, 14000-14016, 22990-23006, 25200-25300
Viber: TCP/UDP 4244, 5242, 5243, 7985
WhatsApp: TCP/UDP 5224-5227, 34784, 45395, 50318, 59234
Nightfall.city: TCP/UDP 1900
AnyDesk: TCP 6568
SPICE: TCP 1923

About the “allow all ports” suggestion: I understand the frustration, but a fully open policy would introduce serious abuse risks (port scanning, spam, malware C&C). The NIP process is the right way to handle this. If you have other specific ports you need, just list them and we’ll review.

Thanks again for the contributions!

Numbless · July 22, 2026, 11:42am

Thanks!

A small clarification:

Already Open in Current Exit Policy (No Action Needed)

Service Port(s)

… …

Syncplay 8995-8999

I can’t see any of these ports in the current exit policy:

ExitPolicy accept *:8888 # HTTP Proxies, NewsEDGE, HUSH coin
ExitPolicy accept *:9000 # WebSocket Nym

Also here:

Syncplay: TCP 8996-8999 (8995 already open)

It is not open.

I decided to bring this to your attention in case this is a mistake.

merve · July 22, 2026, 11:48am

I will double check. Thanks

merve · July 22, 2026, 12:15pm

I will include the following ports in the next NIP proposal. We are planning to publish the proposal on Monday. If you notice any missing ports or think there are any additional ports that should be included, please add them in the comments below this message before then.

Proxy Services

Nodemaven SOCKS5 proxy services:

TCP 1081-2080

Nodemaven HTTP proxy services:

TCP 8081-8079
TCP 8090-9080

Proxy-seller services:

TCP 10100-10999

DarkFi / DarkIRC Services

DarkIRC clearnet communication:

TCP 9600

Minecraft Services

Minecraft Bedrock:

UDP 19132
UDP 19133

Simple Voice Chat mod:

UDP 24454

Space Station 14 Services

Game server communication:

TCP/UDP 1212

Luanti Services

Default and community server ports:

TCP/UDP 30000-30099
TCP/UDP 30420
TCP/UDP 40001
TCP/UDP 40002
TCP/UDP 56008

RustDesk Services

Remote desktop communication:

TCP/UDP 21114-21119

Syncplay Services

Syncplay server communication:

TCP 8995-8999

Star Wars: The Old Republic Services

Game communication:

TCP 80
TCP 8995
TCP 12000-12999
TCP 20000-30000

Battlefield / EA Services

EA authentication and services:

TCP 9988
TCP 17502
TCP 20000-20100
TCP 22990
TCP 42127

Game traffic and media:

UDP 3659
UDP 14000-14016
UDP 22990-23006
UDP 25200-25300

Steam related services:

TCP 27015-27030
TCP 27036-27037
UDP 4380
UDP 27000-27031
UDP 27036

Viber Services

Viber desktop communication:

TCP/UDP 5242
TCP/UDP 5243
TCP/UDP 7985

WhatsApp VoIP Services

WhatsApp voice and video calling:

TCP/UDP 3479-3484
TCP/UDP 5224-5227
TCP/UDP 59234
TCP/UDP 34784
TCP/UDP 45395
TCP/UDP 50318

Nightfall.city Services

Nightfall.city communication:

TCP/UDP 1900

AnyDesk Services

Remote desktop communication:

TCP 6568

SPICE Services

Remote desktop protocol:

TCP 1923

Numbless · July 24, 2026, 1:38pm

Sorry for the late request, I hope there’s still time to add these:

Croc: 9009-9013

Magic Wormhole: 4000, 4001

Iroh: 7842

Numbless · July 24, 2026, 6:24pm

This one should be the last (it took some time and packet sniffing to figure out, I may do some additional testing tomorrow). I can’t guarantee I won’t remember something at the last moment, though.

Telegram (group call support, STUN (UDP)): 32001-32003

Numbless · July 24, 2026, 9:45pm

And I did remember something.

Jitsi: 3478 UDP, 4443 TCP, 5349 TCP, 10000 UDP

Jitsi SIP: 20000-20050 UDP

Sources:

github.com/jitsi/docker-jitsi-meet

Document what ports must be permitted through firewall (and NAT)

opened 08:21PM - 13 Mar 20 UTC

closed 08:46AM - 14 Mar 20 UTC

vorburger

I'm trying to figure out which ports must be externally open and e.g. permit thr…ough an Firewall (both on the `firewalld` on a Fedora Server, or a VM on some Cloud Provider, or e.g. port forwarded on a home router doing NAT from a public IP to a 192.168.1.x). Being a noob and not understanding much of WebRTC and Jitsi internal architecture, and just based on this output of `docker ps` ... ``` $ sudo docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 7607ce4c1628 jitsi/jvb "/init" 2 hours ago Up 2 hours 0.0.0.0:4443->4443/tcp, 0.0.0.0:10000->10000/udp docker-jitsi-meet_jvb_1 ec6a709e6706 jitsi/jicofo "/init" 2 hours ago Up 2 hours docker-jitsi-meet_jicofo_1 5f68b25b3767 jitsi/prosody "/init" 2 hours ago Up 2 hours 5222/tcp, 5269/tcp, 5280/tcp, 5347/tcp docker-jitsi-meet_prosody_1 3c9562f8ad8b jitsi/web "/init" 2 hours ago Up 2 hours 0.0.0.0:8000->80/tcp, 0.0.0.0:8443->443/tcp docker-jitsi-meet_web_1 ``` ... I'm guessing that ports 8000 & 8443 (which I'm about to change to 80 and 443...) and also 4443 and 10000 must be open, but not those 5222/tcp, 5269/tcp, 5280/tcp, 5347/tcp on "prosody" - are those just internal among the containers, but not externally needed? I've tried to figure this out staring at https://github.com/jitsi/docker-jitsi-meet#architecture, but I don't see the 4443 there ... plus there is 20000-20050 there, does that range need to be open? And does it mean only 50 clients can connect? :smile: @saghul would you know and be willing to confirm above or correct me? In exchange I'll make a contribution to the README to clarify this... :smile: If this is already explained on some other doc in the Jitsi project, I'd love to read it, and link it from the README.

merve · July 25, 2026, 4:17am

Proxy Services

Nodemaven SOCKS5 proxy services:

TCP 1080-2080

Nodemaven HTTP proxy services:

TCP 8080-9080 (Note: 8080 already open)

Proxy-seller services:

TCP 10000-10999 (Note: 10000 already open)

DarkFi / DarkIRC Services

DarkIRC clearnet communication:

TCP 9600

Space Station 14 Services

Game server communication:

TCP/UDP 1212

RustDesk Services

Remote desktop communication:

TCP/UDP 21114-21119

Syncplay Services

Syncplay server communication:

TCP 8995-8999

Battlefield / EA Services

EA authentication and services:

TCP 9988
TCP 17502 (already open)
TCP 20000-20100 (already open)
TCP 22990 (already open)
TCP 42127 (already open)

Game traffic and media:

UDP 3659 (already open)
UDP 14000-14016 (already open)
UDP 22990-23006 (already open)
UDP 25200-25300 (already open)

Steam related services:

TCP 27015-27030 (already open)
TCP 27036-27037 (already open)
UDP 4380 (already open)
UDP 27000-27031 (already open)
UDP 27036 (already open)

Viber Services

Viber desktop communication:

TCP/UDP 5242
TCP/UDP 5243
TCP/UDP 7985

WhatsApp VoIP Services

WhatsApp voice and video calling:

TCP/UDP 3479-3484 (already open)
TCP/UDP 5224-5227
TCP/UDP 59234 (already open)
TCP/UDP 34784 (already open)
TCP/UDP 45395 (already open)
TCP/UDP 50318 (already open)

Nightfall.city Services

Nightfall.city communication:

TCP/UDP 1900

AnyDesk Services

Remote desktop communication:

TCP 6568

SPICE Services

Remote desktop protocol:

TCP 1923

Croc Services

Croc file transfer communication:

TCP/UDP 9009-9013

Iroh Services

Iroh communication:

UDP 7842

Telegram Services

Telegram group call support, STUN services:

UDP 32001-32003

Luanti Services

Default and community server ports:

TCP/UDP 30000-30099 (already open - within 12000-65535)
TCP/UDP 30420 (already open - within 12000-65535)
TCP/UDP 40001 (already open - within 12000-65535)
TCP/UDP 40002 (already open - within 12000-65535)
TCP/UDP 56008 (already open - within 12000-65535)

Minecraft Services

Minecraft Bedrock:

UDP 19132 (already open - within 12000-65535)
UDP 19133 (already open - within 12000-65535)

Simple Voice Chat mod:

UDP 24454 (already open - within 12000-65535)

Jitsi Services

Jitsi Meet communication:

UDP 3478 (already open)
TCP 4443 (already open - within 12000-65535)
TCP 5349 (already open)
UDP 10000 (already open - within 12000-65535)

Jitsi SIP communication:

UDP 20000-20050 (already open - within 12000-65535)

Star Wars: The Old Republic Services

Game communication:

TCP 80 (already open)
TCP 8995 (already open - within 12000-65535)
TCP 12000-12999 (already open - within 12000-65535)
TCP 20000-30000 (already open - within 12000-65535)

VMOS Cloud Services

Cloud device control and video streaming:

TCP 30443 (already open - within 12000-65535)

Magic Wormhole Services

Magic Wormhole communication:

TCP/UDP 4000 (already open)
TCP/UDP 4001 (already open - within 12000-65535)

https://nymtech.net/.wellknown/network-requester/exit-policy.txt

merve · July 25, 2026, 6:11am

Note: After the NIP has been published on the forum and before it is uploaded to https://governator.nym.com, you may still request the addition of any ports you would like to include by commenting on the thread where the NIP was published. Any necessary changes can be made before the NIP is uploaded to Governator, so there is no need to rush or be concerned.

Numbless · July 25, 2026, 11:20pm

A small correction: UDP 3659, TCP 8995, and TCP/UDP 4001 are not already open.

Also, the way some of the ports are open (for example, Luanti’s) seems wrong, because the connection to a Luanti server times out or gets dropped, so maybe only TCP or only UDP is accepted when Luanti servers expect the other. It’s just speculation, but it’s really strange.

merve · July 26, 2026, 7:30am

I already shared all the requested ports, the ports I removed, and all of your feedback with @serinko ahead of the NIP-14 publication. He’ll take everything into consideration before publishing it, so there’s no need to worry.

merve · July 27, 2026, 1:04pm