Firewall and ports

Thaumic Cast needs one thing let in: incoming TCP on port 49400, from your own network. The desktop app listens on 49400, or on the first free port up to 49410 if that one is taken, so a firewall rule for 49400 to 49410/tcp covers it. Everything else it does is either outgoing or the usual chatter of finding speakers on a home network.

Why the speakers come to you

Thaumic Cast does not push audio at a speaker. The app gives each speaker an address on this computer, and the speaker fetches the audio from it over HTTP. So the speakers have to be able to reach this computer, and a firewall that turns them away gets you silence: the speakers are found, a cast starts, and nothing plays.

What it uses

What	Port and protocol	Direction	Why
The app’s address	49400/tcp (up to 49410)	In, from your network	The speakers fetch the audio here and send their event updates here. The extension connects here too.
Finding speakers: SSDP	1900/udp, multicast to 239.255.255.250	Out, replies back	The app asks the network which Sonos speakers are in.
Finding speakers: mDNS	_sonos._tcp.local	Out, replies back	A second way of asking, which also works where mDNS is passed between subnets.
Talking to speakers	1400/tcp on each speaker	Out	Sonos speakers take their instructions (play, volume, grouping) on this port.

Thaumic Cast Server uses the same ports. Its HTTP port is 49400 unless you set another with --port or THAUMIC_BIND_PORT.

What to allow

Windows

The first time the app runs, Windows asks whether it may use the network. Allow Private networks. The first-run tour warns you it is coming.

If you said no, or clicked away, allow Thaumic Cast in Windows Security, under Firewall & network protection, Allow an app through firewall, for private networks. A third-party firewall needs the same: incoming 49400 to 49410/tcp from your network.

macOS

On macOS 15 and later, macOS asks whether Thaumic Cast may find devices on your local network. Allow it: without it, the app cannot see your speakers.

macOS, or a firewall such as Little Snitch, may also ask about addresses beginning 224. That is multicast, which is how one asks a whole network a question without knowing anybody’s name. Allow it.

If the macOS firewall is on and set to block incoming connections, allow incoming connections for Thaumic Cast.

Linux

Nobody will ask; a Linux firewall expects you to know. Allow incoming 49400 to 49410/tcp from your network. Replace 192.168.1.0/24 with your own network’s range.

With ufw:

ufw (Ubuntu, Debian)

sudo ufw allow from 192.168.1.0/24 to any port 49400:49410 proto tcp

With firewalld:

firewalld (Fedora)

sudo firewall-cmd --permanent --add-port=49400-49410/tcp
sudo firewall-cmd --reload

If the speakers are found only with the firewall off, it is also turning away the speakers’ replies to discovery, which come back over UDP. Allow UDP from your network to this computer, or add the speakers by IP address.

A VPN gets in the way too

A VPN can send the app’s traffic somewhere your speakers cannot follow. The desktop app then says “The speakers were found, but nothing is getting back from them” or “No speaker can be reached on this network”. Pause the VPN, then select Ask again in Rooms. More in Speakers found, but no sound.

Speakers on another subnet

The least trouble is the same network as the speakers. A different subnet works too, provided traffic is routed both ways and one of these holds:

• your router or access points pass mDNS between the subnets (an Avahi reflector, UniFi’s mDNS setting and the like), so the app can still find the speakers, or
• you add the speakers by IP address: Enter an IP address instead in the first-run tour, or Add a speaker by IP address in Settings.

Thaumic Cast Server in Docker

Use host networking. Bridge networking puts the server behind NAT, which breaks both discovery and the address the speakers are told to fetch from. See Run Thaumic Cast Server.

Still no speakers?

See No speakers found, and check that UPnP is on in the Sonos app: UPnP is off in the Sonos app.