Skip to content

Commit c9a5180

Browse files
weissbadlop
authored andcommitted
listen.md: Suggest non-standard STUN port
STUN via UDP can easily be abused for reflection/amplification DDoS attacks. Therefore, suggest a non-standard port to make it harder for attackers to discover the service. Modern XMPP clients discover the port via XEP-0215 (mod_stun_disco), so there's no advantage in sticking to the standard port.
1 parent 01b6027 commit c9a5180

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

content/admin/configuration/listen.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -243,11 +243,11 @@ Example configuration with disabled TURN functionality (STUN only):
243243
``` yaml
244244
listen:
245245
-
246-
port: 3478
246+
port: 5478
247247
transport: udp
248248
module: ejabberd_stun
249249
-
250-
port: 3478
250+
port: 5478
251251
module: ejabberd_stun
252252
-
253253
port: 5349
@@ -262,7 +262,7 @@ enabled if TURN is enabled. Here, only UDP section is shown:
262262
``` yaml
263263
listen:
264264
-
265-
port: 3478
265+
port: 5478
266266
transport: udp
267267
use_turn: true
268268
turn_ipv4_address: 10.20.30.1
@@ -532,7 +532,7 @@ For example, the following simple configuration defines:
532532

533533
- Port 5269 listens for s2s connections with STARTTLS. The socket is set for IPv6 instead of IPv4.
534534

535-
- Port 3478 listens for STUN requests over UDP.
535+
- Port 5478 listens for STUN requests over UDP.
536536

537537
- Port 5280 listens for HTTP requests, and serves the HTTP-Bind (BOSH) service.
538538

@@ -570,7 +570,7 @@ listen:
570570
shaper: s2s_shaper
571571
max_stanza_size: 131072
572572
-
573-
port: 3478
573+
port: 5478
574574
transport: udp
575575
module: ejabberd_stun
576576
-

0 commit comments

Comments
 (0)