How to attach to the load balancer to the livekit server running in the virtual machine in google cloud

Thanks — I’m responding to your question about attaching a Google Cloud load balancer to a LiveKit server running on a VM. Below are clear, practical steps and important considerations so WebRTC signaling and media work correctly. Key constraints / recommendation • WebRTC needs both TCP (signaling, REST, WebSockets) and UDP (media/RTP). Use a Network (TCP/UDP) Load Balancer so you can forward both protocols on the same frontend IP. HTTP(S) load balancers only handle signaling (TCP) and will not forward UDP media. High-level steps 1. Prepare VM(s) ◦ Ensure your LiveKit server is listening on the ports you plan to use (common defaults: TCP 7880 for signaling, UDP 7882 for media; you may use 443 for TLS signaling if configured). ◦ (Recommended) Put the VM in a Managed Instance Group if you plan to scale horizontally. 1. Reserve a static external IP ◦ Create or reserve a static external IP in Google Cloud. This will be the frontend IP of the load balancer. 1. Create a Network (TCP/UDP) Load Balancer ◦ In Cloud Console: Network Services → Load balancing → Create load balancer → TCP/UDP (Network) Load Balancer. ◦ Frontend: ▪︎ Assign the reserved static IP. ▪︎ Add the ports/protocols you need: ▪︎ TCP: signaling ports (e.g., 7880 — or 443 if you handle TLS on the VM). ▪︎ UDP: media ports (e.g., 7882). ◦ Backend: ▪︎ Add your instance group (or instance) as the backend. ▪︎ Configure backends’ port mapping to match the VM’s listening ports. ◦ Health checks: ▪︎ Create a TCP health check (e.g., check TCP 7880) so the load balancer can mark healthy backends. Health check must reach a reachable port on the VM. 1. Configure firewall rules ◦ Allow ingress to the VM(s) from 0.0.0.0/0 (or your allowed sources) for the TCP and UDP ports you exposed: ▪︎ TCP 7880 (or TCP 443 if used) ▪︎ UDP 7882 (and any other UDP ports you need) ◦ Ensure the health-check IP ranges used by GCP are allowed to reach the health-check port. ◦ Apply network tags or target service accounts to scope rules to the right VM(s). 1. TLS considerations ◦ If you want a single TLS endpoint on port 443: ▪︎ Terminate TLS on the VM (recommended for UDP media, since load balancers usually don’t do UDP TLS termination). ▪︎ Or terminate TLS at an HTTP(S) LB only if you do NOT need UDP through that same LB (media would need a separate UDP-capable flow). 1. TURN servers and fallback ◦ If clients are behind strict NATs, you may need a TURN server. TURN typically uses UDP and TCP; ensure your TURN is reachable and allowed through your firewall/load balancer setup. 1. Testing ◦ Use a client to connect via the load balancer’s static IP / domain and verify both signaling and media (audio/video) work. ◦ Use LiveKit connection test tools or simple WebRTC test pages to confirm UDP connectivity. ◦ Verify health checks show backends as healthy. Notes & alternatives • If you only need to load balance signaling (WebSocket / wss) and will route media separately, you can use an External HTTP(S) load balancer for

wss://

traffic — but this does not forward UDP media and is not sufficient for full WebRTC media path. • Agent servers: Agent servers typically do not require public exposure or a load balancer; they connect to the LiveKit server and are handled differently. If you’d like, I can give step-by-step Cloud Console instructions tailored to your setup. To do that, please tell me: • Which ports your LiveKit server is currently configured to use (signaling TCP port and media UDP port). • Whether you want TLS terminated on the VM or at a load balancer. • Whether you’re using a single VM or a managed instance group for multiple VMs. I’ll walk you through the exact Cloud Console steps and firewall settings once you share those details. Sources: Server lifecycle | LiveKit Documentation | Self-hosted deployments | LiveKit Documentation | Firewall Tips | Running LiveKit on AWS | Running LiveKit on AWS

but 7881 is accessible not 7880

Thanks — I’m replying about your note that port 7881 is accessible (not 7880). I can help you adjust the load balancer and firewall accordingly. A few quick clarifying questions so I give exact steps: 1. Is your LiveKit server listening on TCP 7881 for signaling (instead of 7880), or is 7881 only accessible from certain networks? 2. Which UDP port is your media (RTP) using? Is it still 7882 (or another port)? 3. Do you want TLS terminated on the VM (LiveKit handles TLS) or at the load balancer? What you can do next (summary actions) • Configure the Network (TCP/UDP) Load Balancer frontend to accept TCP on port 7881 (instead of 7880) and UDP on your media port (e.g., 7882). • Map the backend instance/instance group to forward TCP 7881 to the VM’s listening port 7881. • Update your health check to target TCP 7881 so backends are marked healthy. • Update firewall rules to allow ingress to TCP 7881 and your UDP media port(s) from the load balancer/client sources. If you want, I can give step-by-step Cloud Console instructions for creating/updating: 1) the network load balancer frontend/backend and health check (with exact fields to set), and 2) the firewall rules (example ingress rules with network tags). Tell me the answers to the three questions above and whether you’re using a single VM or a managed instance group, and I’ll provide the exact console steps and example firewall rules.

proper steps or guide for depoyment in vm with lb attach ?

Thanks — I’ll provide a clear, step‑by‑step deployment guide for running LiveKit on a Google Cloud VM and attaching a load balancer. First I’ll outline two recommended options (so you can pick which fits your needs), then give the detailed steps for the common choice (Network TCP/UDP Load Balancer for full WebRTC). Before I give exact Cloud Console clicks and example firewall rules, I have two quick questions so the steps match your setup: 1. Which load balancer do you want? ◦ A: Network (TCP/UDP) Load Balancer — recommended for full WebRTC (signaling + UDP media). ◦ B: External HTTP(S) Load Balancer — only for signaling (wss/HTTP); media must be handled separately. 1. Which ports is your LiveKit server actually using on the VM? (you previously noted 7881 is accessible) — please confirm: ◦ Signaling (TCP) port: _ (e.g., 7881 or 7880 or 443) ◦ Media (UDP) port: _ (e.g., 7882 or custom) Also tell me if you’re using a single VM or a Managed Instance Group (MIG). If you want the Network (TCP/UDP) Load Balancer (recommended), here are the step-by-step instructions to follow. Replace ports below with the ports you confirm in your reply. Summary of what we’ll do • Ensure VM and LiveKit are listening on the chosen ports. • Reserve a static external IP. • Create a Network (TCP/UDP) Load Balancer with frontend bindings for TCP (signaling) and UDP (media). • Attach your VM (or instance group) as the backend and create a health check. • Create firewall rules allowing the load balancer and clients to reach the VM ports. • Test connectivity from a client. Detailed steps (Network TCP/UDP Load Balancer) 1. Prepare the VM and LiveKit ◦ Confirm LiveKit is running and listening on the chosen ports. Example defaults: signaling TCP 7880 (or 7881 if that’s what you use) and media UDP 7882. ◦ If using TLS on port 443, ensure LiveKit is configured with certificates and listens on 443. 1. Reserve a static external IP ◦ Console: VPC network → External IP addresses → Reserve static address. Note the reserved IP (this will be the LB frontend IP). 1. Create a health check ◦ Console: Network services → Load balancing → Health checks → Create health check. ◦ Type: TCP ◦ Port: set to the signaling TCP port your server listens on (e.g., 7881). ◦ Configure check interval, timeout, and healthy/unhealthy thresholds (defaults are fine). 1. Create the Network (TCP/UDP) Load Balancer ◦ Console: Network services → Load balancing → Create load balancer → Choose "From Internet to my VMs" → Choose "TCP/UDP Network Load Balancer". ◦ Frontend configuration: ▪︎ IP: select the reserved static external IP. ▪︎ Protocols/ports: add TCP for signaling (e.g., 7881) and UDP for media (e.g., 7882). If you need additional ports add them here. ◦ Backend configuration: ▪︎ Backend type: Instance group (select your instance group or single instance backend). ▪︎ Backend port: map to the VM listening ports (e.g., TCP 7881, UDP 7882). ▪︎ Attach the health check you created. ◦ Session affinity: usually NONE for WebRTC. ◦ Create the LB. 1. Firewall rules ◦ Create firewall rules to allow ingress to your VM network on the ports you exposed: ▪︎ Rule 1 (TCP signaling): Allow ingress tcp:<signaling-port> from 0.0.0.0/0 (or restrict to client IP ranges as needed). Target by network tag or service account used by VM. ▪︎ Rule 2 (UDP media): Allow ingress udp:<media-port> from 0.0.0.0/0 (or restrict). ▪︎ Rule 3 (Health checks): Allow GCP health check IP ranges to reach the signaling port — or allow tcp:<signaling-port> from 35.191.0.0/16 and 209.85.152.0/22 (or use the documented GCP health check ranges). ◦ Apply network tags to the VM and scope rules to those tags. 1. TLS considerations ◦ If you want TLS on signaling: ▪︎ Terminate TLS on the VM (LiveKit handles TLS): use TCP 443 on frontend/backends and keep UDP media on separate UDP ports. ▪︎ If you terminate TLS at an HTTP(S) LB, note HTTP(S) LB does NOT support UDP; media must be reachable separately. 1. Testing ◦ Connect a client to the LB IP or DNS (wss//&lt;IP or host&gt;<signaling-port>) and join a room. Verify audio/video flows. ◦ Check health checks on the Load Balancer page to ensure the instance is healthy. ◦ If media does not flow, check that UDP port is open and reachable (use tools like udping or WebRTC diagnostics). Optional: Using Managed Instance Group (MIG) • If you plan to scale, place LiveKit VMs in a MIG so you can autoscale. Ensure the startup script configures LiveKit with the correct instance-specific configuration (room/cluster settings) and that persistent storage or state is handled appropriately. If you want, I can provide: • Exact Cloud Console click-by-click steps (with the specific port numbers you confirm). • Example gcloud commands and sample firewall-rule commands for automation. • Example health check settings and troubleshooting commands (e.g., how to check port listen state on the VM). Tell me: • Which LB option (A or B) you prefer, and • The exact signaling TCP port and media UDP port your LiveKit server uses, and • Single VM or MIG. I’ll then give the precise Cloud Console steps or gcloud commands tailored to your setup.