In livekit connection test I am able to connect via websocket and application lb seems to be working but I'm not able to establish webrtc connection and I think my nlb is not working as it should livekit: port: 7880 log_level: info rtc: tcp_port: 7881 port_range_start: 50000 port_range_end: 60000 use_external_ip: true redis: address: "<REDACTED_REDIS_ADDRESS>" keys: # key_file: /etc/livekit/keys.yaml <REDACTED_API_KEY_1>: <REDACTED_API_SECRET_1> # webhook secret <REDACTED_API_KEY_2>: <REDACTED_API_SECRET_2> turn: enabled: true # Must match domain of your tls cert domain: "<REDACTED_DOMAIN>" # secretName: <tlssecret> external_tls: true tls_port: 443 udp_port: 3478 serviceType: LoadBalancer loadBalancerAnnotations: service.beta.kubernetes.io/aws-load-balancer-type: "nlb" service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing" service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "<REDACTED_AWS_CERT_ARN>" service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443" service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "true" # webhook: <webhook configuration> # room: <default settings for new rooms> # region: <set for multi-region deploys> #storeKeysInSecret: # enabled: true # existingSecret: "livekit-keys" # keys: # LK_API_KEY: LK_API_SECRET # LK_WS_KEY: LK_WS_SECRET loadBalancer: type: alb servicePort: 7880 tls: - hosts: - "<REDACTED_DOMAIN>" annotations: alb.ingress.kubernetes.io/certificate-arn: "<REDACTED_AWS_CERT_ARN>" # Health check settings turnLoadbalancer: enable: true autoscaling: enabled: false minReplicas: 1 maxReplicas: 5 targetCPUUtilizationPercentage: 60 # targetMemoryUtilizationPercentage: 80 serviceAccount: # Specifies whether a service account should be created create: false # Annotations to add to the service account annotations: {} # The name of the service account to use. # If not set and create is true, a name is generated using the fullname template name: "" podHostNetwork: true

Thanks for reaching out, gautam. I'm an AI assistant and I'm here to help. Give me a moment while I research this topic.

How do I check if my udp traffic is blocked

To help you check if UDP traffic might be blocked, here are some friendly steps you can try: • Give the LiveKit Connection Test Utility a go—it’s a great tool that tries WebRTC connections over UDP and will let you know if UDP traffic is being blocked. • Take a peek at the client logs for any warnings about missing public IPv4 UDP candidates. This can be a sign that UDP traffic is either blocked or not set up quite right. • Try forcing clients to use TURN relay-only mode by setting

iceTransportPolicy: 'relay'

in your client configuration. If this fixes the problem, it’s a good indication that UDP is indeed blocked. • Double-check that UDP ports, like 50000–60000, are open in your firewall and NLB settings to keep things flowing smoothly. • Use handy tools such as the WebRTC Trickle ICE sample (

<WEBRTC_TRICKLE_ICE_URL>

) to test STUN/TURN connectivity and see if UDP candidates are being gathered properly. If you’d like, I’m here to walk you through any of these steps or answer any questions you have. Just let me know! Sources: Connecting to LiveKit | LiveKit Docs | Firewall Tips | src/connectionHelper/checks/connectionProtocol.ts | Diagnosing Connection Errors with Connection Test Utility | Ports and firewall | LiveKit Docs

Livekit connection test connects to server but fails to establish pc connection

It looks like the LiveKit connection test is reaching the server but having trouble establishing a peer connection. Let’s work through some troubleshooting steps together: • Try running the WebRTC, WebSocket, and TURN connection checks using the LiveKit Connection Test Utility. If you see that UDP fails but TURN over TCP/443 works, it usually means UDP traffic is being blocked somewhere. • You can force the client to use TURN relay-only mode by setting

iceTransportPolicy: 'relay'

in the client configuration. This helps by routing media through TURN servers and avoiding UDP-related issues. • It’s a good idea to check your firewall and NLB setup to make sure UDP ports (like 50000–60000) are open and correctly routed. • Keep an eye on the ICE and connection states in your client logs. Look out for missing ICE candidates or connection states changing to 'failed' or 'disconnected', as these can give helpful clues. • Also, try whitelisting

*.turn.livekit.cloud

on port 443 to allow TURN/TLS traffic, which often improves compatibility on networks with stricter rules. If you’re still running into issues after trying these steps, please feel free to share any specific errors or logs from your connection test. I’m here to help you dig deeper and get this sorted out! Sources: Diagnosing Connection Errors with Connection Test Utility | Firewall Tips | solutions/doorbell_local/main/webrtc_test.html | Connecting to LiveKit | LiveKit Docs | src/room/RTCEngine.ts