Port 3478 (TCP and UDP) is where the STUN/TURN server runs, usually coturn. Nextcloud Talk needs it so calls work between participants behind NAT or corporate firewalls. In Nextcloud under Administration › Talk, add the TURN server as turn.example.com:3478 with the static-auth-secret from turnserver.conf, protocols UDP and TCP.
Publicly open: 3478 TCP+UDP plus the relay range, by default UDP 49152–65535 (narrow it with min-port/max-port). For very restrictive networks, also offer TURN over TLS on 443 (TURNS).
Common errors: calls work on the LAN but not externally – relay ports blocked or external-ip missing behind NAT. Beyond roughly 4–5 participants TURN no longer helps; Talk then needs the High-Performance Backend.
Check
turnutils_stunclient -p 3478 turn.example.com