Why can’t external participants in a WebMeeting enable their camera or video?

Problem:

When attempting to enable the camera during a meeting, the message “The connection to the media server could not be established” appears.

Cause:

In most cases, the cause is active NAT for the STUN rule in the firewall or missing outbound NAT rules.

LiveKit uses its own STUN queries to determine its WAN IP and does not rely on XCC at all. Its operating principle is not comparable to that of XCC. LiveKit performs a new query with every “call,” unlike XCC, which performs a single query when the service starts.

As with the ports for SRTP packets from voice streams, the ports for SRTP packets from the video stream must also be NAT-translated 1:1 on the outgoing side.

Due to the way LiveKit determines its IP address—as opposed to XCC—it may be necessary to configure external STUN rules specifically, depending on the firewall.

Solution:

Logging:

The first step is to generate the appropriate log files. You’ll need the WebRTC logs from the client for an active video meeting:

Start a meeting from a client where the video isn’t working. After joining the meeting, click on “Settings” in the header to open a panel on the left side. Download the logs using the download button.

You will receive a .zip file.

Analysis:

Open the “livekit-webrtc.log” file and look for the “Remote Candidates” section.

You can identify the worst-case scenario by the fact that the candidate with the external IP address is using a different port.

Port 33858 on the right is the one used locally by LiveKit.

Port 34799 on the left is the result of the normal NAT performed by the firewall in use.

In this case, however, you must ensure that the firewall does not alter the LiveKit’s local source port during the STUN request.

Alternatively, you can use a Wireshark trace to verify how the ports are sent.

Start the Wireshark trace on the XCC. Enter “STUN” in the filter:

The two highlighted ports must match. If this is not the case, as shown in the screenshot, you’ll need to adjust the firewall settings as described below.

What settings do I need to configure?

How this is configured on the firewall side depends on the manufacturer. As mentioned above, the following generally applies:

For video, STUN discovery occurs with every new client connection. Both the public IP address determined via STUN and the public UDP port are used to identify the WebRTC candidate. As a result, the firewall’s NAT behavior is relevant for the video connection.

Vendor-Specific Configuration:

Please note: C4B does not configure third-party systems. The following information is based on customer support cases and may not lead to success in every scenario. An experienced firewall administrator should always review the configuration, in part to avoid potential security risks. We assume no liability whatsoever.