For FFmpeg running on a VPS and publishing directly to YouTube, allow the VPS to make an outbound RTMPS connection over TCP port 443 if outbound traffic is restricted. You normally do not need to open inbound port 1935 for this setup. Port 1935 is relevant when the VPS itself runs an RTMP listener that accepts a stream from another encoder.
The exact firewall steps depend on your VPS provider, Linux distribution, current rules, and SSH port. Configure the network direction first, then apply the matching policy in both the host firewall and any separate provider firewall.
Identify which streaming setup you are using
The key firewall question is whether FFmpeg sends the video straight to YouTube or whether another encoder sends it to an RTMP server on your VPS first. These create different network flows.
| Setup | Connection direction | Firewall need | Does the VPS need a public listener? |
|---|---|---|---|
| FFmpeg on the VPS publishes directly to YouTube | Outbound from VPS to YouTube | Permit outbound RTMPS over TCP 443 if egress is restricted | No, not for direct publishing |
| External encoder publishes to an RTMP service on the VPS | Inbound from encoder to VPS, then onward from VPS to YouTube | Permit inbound TCP 1935 only if the service listens on that port; separately allow the service’s outbound path to YouTube | Yes, for the configured RTMP listener |
YouTube Help recommends RTMPS, a secure extension of RTMP. Google for Developers specifies that the RTMPS connection must reach port 443 on the ingestion server. FFmpeg documentation lists 1935 as RTMP’s default port, but that does not make it YouTube’s direct-publishing port.
Recommended Free Tools
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Configure firewall rules for direct FFmpeg-to-YouTube streaming
1. Get the current RTMPS endpoint and stream key
In YouTube Live Control Room, obtain the RTMPS URL and stream key for the broadcast. Use the RTMPS URL exactly as supplied, including its server and path, and keep the key private. Confirm that the endpoint uses the rtmps protocol. Do not substitute an inbound VPS rule for the connection FFmpeg initiates to YouTube.
2. Inspect existing firewall policy before changing it
On Ubuntu systems using UFW, check current policy with:
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
sudo ufw status
Before enabling or tightening an incoming-deny policy over SSH, make sure the actual SSH port is allowed, with any source-address restrictions your setup uses. If you lock out SSH, recovery may require your provider’s console or rescue access. UFW examples are not a complete security policy, and command syntax varies by firewall manager and distribution.
3. Permit outbound RTMPS only if egress is restricted
If the host allows outbound connections by default, an extra broad outbound allow rule may be unnecessary. If egress is restricted, allow FFmpeg to connect to the RTMPS hostname and TCP port 443 given by YouTube. Prefer a destination-scoped rule when your firewall supports it. The exact syntax differs between UFW, nftables, firewalld, and other tools; consult the documentation for the firewall and OS image actually installed on your VPS.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
This is an outbound connection from the VPS. An inbound allow rule for TCP 443 does not permit FFmpeg’s outbound traffic, and opening inbound TCP 1935 does not solve an outbound RTMPS block.
4. Check the provider firewall as well as the Linux firewall
Some VPS providers offer a separate network firewall in their control panel. A host rule cannot override a provider rule that blocks the same traffic. Check the provider’s current documentation for its egress controls and any defaults, then ensure the provider layer permits the outbound RTMPS connection. There is no single provider-panel procedure for all Indian VPS services.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
5. Test the stream and monitor YouTube’s status
Start with a representative test rather than assuming a firewall change guarantees a healthy broadcast. Confirm that FFmpeg is using the intended RTMPS URL and key, that the connection completes, and that YouTube reports a healthy incoming stream. If the connection times out or TLS negotiation fails, check the endpoint, port, firewall rules at both layers, and whether the encoder supports RTMPS. YouTube recommends testing before going live and monitoring stream health.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When inbound TCP 1935 is actually needed
Open inbound TCP 1935 only when the VPS runs an RTMP service configured to listen on that port and a separate encoder must publish to it. Restrict the allowed source addresses where practical. Avoid exposing monitoring panels, administration interfaces, or other service ports publicly unless the design requires them.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
In this relay or ingest architecture, an external encoder connects to the VPS first. The VPS then needs its own onward connection to YouTube, with the appropriate outbound RTMPS path. If the RTMP service listens on a non-default port, the inbound firewall rule must match that configured port rather than assuming 1935.
Firewall access is only one part of a working stream
A reachable YouTube endpoint does not guarantee acceptable video quality. YouTube’s encoder guidance recommends RTMPS, constant bitrate (CBR), and a two-second keyframe interval; it says not to exceed four seconds. It lists H.264, H.265/HEVC, and AV1 among supported video codecs. Follow the current YouTube settings table for your chosen codec, resolution, and frame rate.
For H.264 at 1080p30, YouTube lists 4 Mbps minimum and 10 Mbps recommended. For H.264 at 1080p60, it lists 6 Mbps minimum and 17 Mbps recommended. These figures are YouTube’s published recommendations; the cited settings page does not state a publication year. Also check the VPS’s available network capacity and the full FFmpeg configuration, not just firewall reachability.
Before broadcasting, verify that you have the rights to the video, audio, and other material in the stream and review YouTube’s applicable live-stream and monetization policies. A firewall configuration does not determine whether content is permitted or eligible for monetization.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Troubleshooting common connection problems
| Symptom | Likely check | What to do |
|---|---|---|
| Connection times out | Outbound TCP 443 is blocked on the host or provider firewall, or the destination details are wrong | Check egress rules at both firewall layers and compare the RTMPS hostname, port, and path with YouTube Live Control Room. |
| TLS or secure-connection failure | Wrong protocol or endpoint, or an encoder/configuration that does not support RTMPS | Use the RTMPS URL from YouTube and verify RTMPS support in the FFmpeg build and command. |
| Inbound encoder cannot reach the VPS | The VPS is acting as an ingest server, but the listener or inbound rule is absent or on a different port | Confirm the RTMP service is running and listening on the configured port; allow inbound access only from necessary sources. |
| SSH stops responding after firewall changes | The restrictive inbound policy was enabled without allowing the actual SSH port | Use provider console or rescue access to restore the SSH rule, then review the policy before reapplying it. |
| Connection reaches YouTube but stream is unhealthy | Encoder settings, stream key, bitrate, keyframes, or source media may be wrong | Check YouTube’s stream-health information, confirm the key and endpoint, and compare codec, bitrate, frame rate, and keyframe interval with YouTube’s current guidance. |
Or let it run in the cloud
If your goal is an always-on YouTube channel rather than maintaining an FFmpeg VPS, StreamNeo is a cloud option: upload a recording or build a playlist, add your YouTube stream key, and go live. It loops uploaded videos; it does not broadcast a camera feed. Nothing has to stay on at home, it streams the uploaded quality up to 4K 60fps at one flat price per slot, and it can automatically recover if YouTube drops the stream. The first day is free with no card. Monthly service is $9.99 per month.
Quick Recap
See StreamNeo or start the free first day.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
