From 32c3d7a0274af40459c9a7823d83d18fa0dc47b8 Mon Sep 17 00:00:00 2001 From: Piwccle Date: Wed, 28 Oct 2026 11:59:09 +0100 Subject: [PATCH] openvidu-deployment: Azure opens the whole WebRTC TCP range The TCP rule listed only ports 50000 and 60000; it now covers 50000-60000, as UDP does. Checked live on Azure elastic. --- openvidu-deployment/CHANGELOG.md | 3 +++ .../pro/elastic/azure/cf-openvidu-elastic.bicep | 5 +---- .../pro/elastic/azure/cf-openvidu-elastic.json | 7 ++----- openvidu-deployment/pro/ha/azure/cf-openvidu-ha.bicep | 5 +---- openvidu-deployment/pro/ha/azure/cf-openvidu-ha.json | 7 ++----- .../pro/singlenode/azure/cf-openvidu-singlenode.bicep | 5 +---- .../pro/singlenode/azure/cf-openvidu-singlenode.json | 7 ++----- 7 files changed, 12 insertions(+), 27 deletions(-) diff --git a/openvidu-deployment/CHANGELOG.md b/openvidu-deployment/CHANGELOG.md index ea17a5c68..5da94a424 100644 --- a/openvidu-deployment/CHANGELOG.md +++ b/openvidu-deployment/CHANGELOG.md @@ -138,6 +138,9 @@ in the [openvidu-oracle](https://github.com/OpenVidu/openvidu-oracle) and A redeploy still cannot set the fixed, minimum or maximum number of Media Nodes below the Media Nodes running (`UnsupportedCapacity`); the administration documentation describes how to remove them first. +- Professional single node, Elastic and High Availability: the network security group rule for WebRTC over + TCP opened only ports 50000 and 60000 instead of the range between them. It now opens 50000-60000, as the + rule for UDP does. - Single node and Elastic: the network security group still allowed port 9000 (MinIO) from the Internet. MinIO does not run in Azure deployments, which store recordings and application data in Azure Blob Storage, and the other clouds have kept this port closed since 3.9.0. The rule is removed. diff --git a/openvidu-deployment/pro/elastic/azure/cf-openvidu-elastic.bicep b/openvidu-deployment/pro/elastic/azure/cf-openvidu-elastic.bicep index b4ec19901..9edb709cc 100644 --- a/openvidu-deployment/pro/elastic/azure/cf-openvidu-elastic.bicep +++ b/openvidu-deployment/pro/elastic/azure/cf-openvidu-elastic.bicep @@ -2143,10 +2143,7 @@ resource openviduMediaNodeNSG 'Microsoft.Network/networkSecurityGroups@2023-11-0 sourceAddressPrefix: '*' sourcePortRange: '*' destinationAddressPrefix: '*' - destinationPortRanges: [ - '50000' - '60000' - ] + destinationPortRange: '50000-60000' access: 'Allow' priority: 150 direction: 'Inbound' diff --git a/openvidu-deployment/pro/elastic/azure/cf-openvidu-elastic.json b/openvidu-deployment/pro/elastic/azure/cf-openvidu-elastic.json index 087d779a8..d31c3dfe0 100644 --- a/openvidu-deployment/pro/elastic/azure/cf-openvidu-elastic.json +++ b/openvidu-deployment/pro/elastic/azure/cf-openvidu-elastic.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.46.1.21595", - "templateHash": "5733974944942002101" + "templateHash": "10387525853368254116" } }, "parameters": { @@ -1152,10 +1152,7 @@ "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*", - "destinationPortRanges": [ - "50000", - "60000" - ], + "destinationPortRange": "50000-60000", "access": "Allow", "priority": 150, "direction": "Inbound" diff --git a/openvidu-deployment/pro/ha/azure/cf-openvidu-ha.bicep b/openvidu-deployment/pro/ha/azure/cf-openvidu-ha.bicep index c03a3e58e..00865e168 100644 --- a/openvidu-deployment/pro/ha/azure/cf-openvidu-ha.bicep +++ b/openvidu-deployment/pro/ha/azure/cf-openvidu-ha.bicep @@ -3137,10 +3137,7 @@ resource openviduMediaNodeNSG 'Microsoft.Network/networkSecurityGroups@2023-11-0 sourceAddressPrefix: '*' sourcePortRange: '*' destinationAddressPrefix: '*' - destinationPortRanges: [ - '50000' - '60000' - ] + destinationPortRange: '50000-60000' access: 'Allow' priority: 150 direction: 'Inbound' diff --git a/openvidu-deployment/pro/ha/azure/cf-openvidu-ha.json b/openvidu-deployment/pro/ha/azure/cf-openvidu-ha.json index 41b0efd8c..49fb01047 100644 --- a/openvidu-deployment/pro/ha/azure/cf-openvidu-ha.json +++ b/openvidu-deployment/pro/ha/azure/cf-openvidu-ha.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.46.1.21595", - "templateHash": "128203215953929559" + "templateHash": "11080605156043027678" } }, "parameters": { @@ -1954,10 +1954,7 @@ "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*", - "destinationPortRanges": [ - "50000", - "60000" - ], + "destinationPortRange": "50000-60000", "access": "Allow", "priority": 150, "direction": "Inbound" diff --git a/openvidu-deployment/pro/singlenode/azure/cf-openvidu-singlenode.bicep b/openvidu-deployment/pro/singlenode/azure/cf-openvidu-singlenode.bicep index 6facb61f6..778ce9357 100644 --- a/openvidu-deployment/pro/singlenode/azure/cf-openvidu-singlenode.bicep +++ b/openvidu-deployment/pro/singlenode/azure/cf-openvidu-singlenode.bicep @@ -995,10 +995,7 @@ resource webServerSecurityGroup 'Microsoft.Network/networkSecurityGroups@2023-11 sourceAddressPrefix: '*' sourcePortRange: '*' destinationAddressPrefix: '*' - destinationPortRanges: [ - '50000' - '60000' - ] + destinationPortRange: '50000-60000' access: 'Allow' priority: 190 direction: 'Inbound' diff --git a/openvidu-deployment/pro/singlenode/azure/cf-openvidu-singlenode.json b/openvidu-deployment/pro/singlenode/azure/cf-openvidu-singlenode.json index 467c906df..597bd8d33 100644 --- a/openvidu-deployment/pro/singlenode/azure/cf-openvidu-singlenode.json +++ b/openvidu-deployment/pro/singlenode/azure/cf-openvidu-singlenode.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.46.1.21595", - "templateHash": "17066739396447275453" + "templateHash": "3939132145262526969" } }, "parameters": { @@ -510,10 +510,7 @@ "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*", - "destinationPortRanges": [ - "50000", - "60000" - ], + "destinationPortRange": "50000-60000", "access": "Allow", "priority": 190, "direction": "Inbound"