Ports & firewall
Almost everything runs over a single port. Only open what you actually use.
| Port | Purpose | Exposure |
|---|---|---|
8095 tcp | Web UI, console, and every HTTP client protocol — XC, M3U, Stalker/MAG, Enigma2, HDHomeRun, web player | Public |
9982 tcp | HTSP server for Kodi | Only if remote Kodi is used |
8888 tcp | OSCam web interface | This server only (127.0.0.1; 2.9.454). From another computer: ssh -L 8888:127.0.0.1:8888 |
9001 tcp | OSCam DVBAPI | Internal |
18097 tcp | AI sidecar | This server only (127.0.0.1; 2.9.454) — it has no login, never open it |
18098 tcp | Node WebSocket (remote workers) | Only if you run fleet nodes |
outbound 443 | Licence validation to license.bgpvr.com | Required |
Cloudflare must be OFF (grey cloud) for streaming hostnames
MPEG-TS streams cannot sit behind Cloudflare's HTTP proxy — its 100-second response timeout kills live streams. Keep any hostname used for playback DNS-only.
A reverse proxy will not carry HTSP
Port 9982 is raw TCP, not HTTP. An nginx/Caddy reverse proxy cannot forward it — use port forwarding or a TCP proxy.