Problem
Backup internet connection has restrictive firewall rules that block the required ingest protocol.
Solution
Root Cause / Diagnostic:
Secondary ISP connections (such as enterprise secondary fiber, 5G cellular failovers, or guest broadband) often implement aggressive perimeter security profiles or strict NAT policies. Standard outbound RTMP (TCP port 1935) or SRT (UDP port 9998/dynamic) traffic is frequently blocked or dropped by default stateful firewall rules, rendering the backup network completely useless when the primary fiber line drops.
Actionable Fix:
1. Audit the backup router/firewall rules to explicitly whitelist outbound TCP port 1935 (RTMP), TCP port 443 (RTMPS), and relevant UDP ports for SRT/WebRTC streaming.
2. Test connection viability directly on the backup network by pushing a private 15-minute test stream via RTMPS (encrypted RTMP over port 443) to bypass basic port filtering.
3. Establish static IP routing and verify that the backup gateway does not enforce symmetric NAT or deep packet inspection on broadcast traffic.
Pro Tip:
Prefer RTMPS (port 443) over legacy unencrypted RTMP (port 1935) across all configurations, as corporate and cellular firewalls virtually never block outbound TLS traffic on port 443.
Secondary ISP connections (such as enterprise secondary fiber, 5G cellular failovers, or guest broadband) often implement aggressive perimeter security profiles or strict NAT policies. Standard outbound RTMP (TCP port 1935) or SRT (UDP port 9998/dynamic) traffic is frequently blocked or dropped by default stateful firewall rules, rendering the backup network completely useless when the primary fiber line drops.
Actionable Fix:
1. Audit the backup router/firewall rules to explicitly whitelist outbound TCP port 1935 (RTMP), TCP port 443 (RTMPS), and relevant UDP ports for SRT/WebRTC streaming.
2. Test connection viability directly on the backup network by pushing a private 15-minute test stream via RTMPS (encrypted RTMP over port 443) to bypass basic port filtering.
3. Establish static IP routing and verify that the backup gateway does not enforce symmetric NAT or deep packet inspection on broadcast traffic.
Pro Tip:
Prefer RTMPS (port 443) over legacy unencrypted RTMP (port 1935) across all configurations, as corporate and cellular firewalls virtually never block outbound TLS traffic on port 443.