Jitsi works with 2 people but not with 3: how to fix it

This is the most common Jitsi problem there is, and it has a satisfying explanation.

Why it happens

• Two people: Jitsi connects the two browsers directly (peer to peer). The server only relays signalling. Everything works even if the videobridge is unreachable.
• Three or more: the call moves onto Jitsi Videobridge (JVB). Every participant now sends and receives media through the server on UDP port 10000.

If that path is broken, the moment the third person joins you see black tiles, frozen video, audio that cuts out, or people bouncing in and out.

Fix 1: open 10000/udp everywhere

There are usually two firewalls, and both must allow it.

The server firewall:

sudo ufw allow 10000/udp
sudo ufw status

The cloud firewall (AWS security group, GCP firewall rule, DigitalOcean cloud firewall, Hetzner firewall): add an inbound rule for UDP 10000 from 0.0.0.0/0. This is the one people miss, because the server firewall looks correct.

Confirm the videobridge is listening on the host:

sudo ss -ulnp | grep 10000

Fix 2: advertise the public IP

Cloud servers sit behind NAT: the machine sees a private IP like 172.31.x.x, while users reach a public one. The videobridge must tell clients the public address.

It usually discovers it through STUN. When it does not, set it explicitly in .env:

JVB_ADVERTISE_IPS=203.0.113.10

Then recreate the videobridge:

docker compose up -d --force-recreate jvb

On AWS, use an Elastic IP so this address never changes.

Fix 3: check the videobridge is healthy

docker compose ps
docker compose logs --tail 100 jvb
docker compose logs --tail 100 jicofo

Look for the bridge registering with Jicofo. If Jicofo reports no bridge available, the JVB cannot log in to Prosody; check that JVB_AUTH_PASSWORD in .env has not changed since the first start.

Fix 4: corporate networks that block UDP

Some office and hotel networks block all outbound UDP. Those users fail even when your server is correct. A TURN server listening on TCP 443 (TLS) lets them relay media over a port that is always allowed.

Verify

Join from three devices on different networks, for example two laptops and a phone on mobile data. All three should see each other for several minutes.

Still broken?

We fix this every week. Send us the details and we will usually find it within one session, or deploy a correctly configured server with one click.