# Shredstream Firewall Setup

> Expose and verify the public UDP port used by your Shredstream destination.

Canonical: https://nolimitnodes.com/docs/api-reference/shredstream/firewall

## Required network path

NoLimitNodes sends packets directly to the public IPv4 and UDP port that you register. Your network must route that target to the receiver.

```text
NoLimitNodes gateway → public IPv4:UDP port → firewall or NAT → receiver socket
```

## Host firewall example

Choose the command that matches your system. Replace `20000` with your port.

```bash UFW
sudo ufw allow 20000/udp
```

```bash firewalld
sudo firewall-cmd --permanent --add-port=20000/udp
sudo firewall-cmd --reload
```

## Cloud firewall

Create an inbound UDP rule for the configured port. V1 does not publish a fixed NoLimitNodes source-IP allowlist, so do not create a rule that depends on one.

> Warning: Opening UDP to the internet lets other hosts send datagrams to the same port. Isolate the receiver, validate packet shape, limit process privileges, and keep the operating system patched.

## Verify receipt

```bash
sudo tcpdump -n -i any "udp and dst port 20000"
```

If packet capture sees traffic but the application does not, check the bind address, container port mapping, socket buffer, and process permissions. If packet capture sees nothing, check the dashboard status, public route, security group, firewall, and NAT mapping.