OMT WHEP Gateway v1.4.4

Stream OMT video sources to any web browser via WebRTC/WHEP. Deploy as a Linux appliance — boot, connect, stream.

Debian 12 live appliance · 30-day free trial · v1.4.4 (stable)

Or try v1.5.14-alpha with per-viewer stats, WHIP outputs & system monitoring (912 MB) →

What It Does

The OMT WHEP Gateway bridges Open Media Transport video sources to standard WebRTC/WHEP, so anyone with a web browser can watch live streams — no plugins, no apps, no downloads.

OMT → WebRTC: Receives OMT sources on the local network and re-encodes them to WebRTC for browser playback
WHIP Output (Alpha): Push channels to remote WHIP endpoints — CDNs, streaming platforms, or other WebRTC ingest servers. Configure per-channel from the web UI
Multi-Codec: H.264, HEVC, AV1 with hardware encoding support (Intel VAAPI/QSV, NVIDIA NVENC, AMD AMF)
Web UI: Channel management, live preview, multiview grid, real-time encoding stats
Share Links: Each channel gets a watch URL you can send to anyone
Cloudflare Tunnel: Stream to remote viewers with zero port forwarding
WebSocket Relay: Automatic fallback for viewers behind strict firewalls

Use Cases

Remote Monitoring

Give directors, producers, or clients a browser link to watch OMT camera feeds from anywhere. No software to install — just open the link on a phone, tablet, or laptop. Combine with Cloudflare Tunnel for secure access over the internet with zero port forwarding.

Multi-Site Event Production

Stream venue feeds to a remote production hub or overflow rooms. Sub-200ms latency means talkback and live switching stay in sync. Run multiple channels on a single gateway — one per camera or source.

House of Worship & Corporate AV

Let congregation members or remote staff watch services and meetings live in a browser. No CDN fees, no third-party streaming platforms — just a direct WebRTC link from your OMT infrastructure to the viewer.

Broadcast Confidence Monitoring

Replace expensive hardware monitors with browser tabs. Open a multiview grid of all your OMT sources on any screen in the building — green rooms, control rooms, producer desks. No additional hardware or licenses per display.

1 Install the Appliance

The gateway ships as a bootable Linux ISO. Flash it to a USB drive and boot on any x86_64 PC, NUC, or server.

Flash the ISO

Download the ISO (906 MB)
Flash to a USB drive using Rufus (Windows) or balenaEtcher (Windows/Mac/Linux)
Boot your target machine from USB

Live Boot & Setup

The ISO boots into a live environment. A setup wizard runs on the console to configure hostname, admin password, GPU encoding, and TLS mode.

Install to Disk

To install permanently, run omt-install-to-disk from the console. This copies the live system to a local disk so settings persist across reboots.

Important: The install command will erase the target disk. Use a dedicated PC or NUC — do not install on a machine with data you want to keep.

First-Boot Services

After setup, the appliance will:

Auto-detect your GPU (Intel VAAPI, NVIDIA NVENC, AMD AMF)
Generate a self-signed TLS certificate
Start the gateway service and display the dashboard URL on the console

2 Open the Dashboard

Open a web browser on any device on the same network and go to:

https://<appliance-ip>

The IP address is shown on the appliance console after boot

Certificate warning: Your browser will show a security warning because the certificate is self-signed. Click Advanced → Proceed (or install the CA certificate from http://<appliance-ip>/api/ca.crt).

WHEP Gateway dashboard showing channels, sources, and system stats

Dashboard — channel list with viewer counts, system CPU/RAM/network stats

Alpha

Per-viewer WebRTC stats showing session details, IP, RTT, and packet loss

Viewer stats — click a viewer count to see per-session WebRTC details (IP, RTT, packet loss, bytes sent)

3 Configure HTTPS

Open Settings → TLS / HTTPS in the dashboard. Choose one of these modes:

Mode	Best For	Notes
Self-Signed CA	LAN / internal	Default. Install the CA cert on client devices to avoid browser warnings.
Let's Encrypt (Auto)	Public servers	Point a domain to the server, open ports 80 + 443. Caddy gets a trusted cert automatically.
Let's Encrypt (DNS-01)	Wildcard / private	Get wildcard certs via Cloudflare, Route53, or Google Cloud DNS.
Cloudflare Tunnel	Remote access	Zero-trust access with no open ports. Temporary URL or bring your own domain.
Manual Certificate	Bring your own	Upload your own PEM certificate and key.

Click Save Settings after making changes. Caddy reloads the configuration automatically.

TLS/HTTPS settings with Cloudflare Tunnel connected

Settings — TLS modes with Cloudflare Tunnel active and public URL

4 Add a Channel

Click + Add Channel on the dashboard. The gateway automatically discovers OMT sources on your network.

Channel Settings

Setting	Description
Name	Display name for the channel (e.g. "Studio A Live")
Source	Select from discovered OMT sources on your network
Video Codec	H.264 (CPU), HEVC, AV1 — or hardware variants (VAAPI, QSV, NVENC, AMF)
Preset	Encoding speed/quality trade-off. Faster = less CPU, lower quality.
Bitrate	200 kbps – 20 Mbps. Lower for AV1/HEVC, higher for H.264.
Keyframe Interval	1–5 seconds. Shorter = faster seeking, slightly more bandwidth.
Audio	Enable/disable. Opus codec, 32–320 kbps.
Max Viewers	1–200 concurrent WebRTC viewers per channel.
Auto-start	Automatically start encoding when the gateway boots.

Codec Recommendations

Codec	1080p Bitrate	4K Bitrate
H.264	2–8 Mbps	20–35 Mbps
HEVC	1–4 Mbps	8–15 Mbps
AV1	500 kbps–4 Mbps	6–12 Mbps

Tip: AV1 delivers excellent quality at very low bitrates but requires more CPU. Use hardware encoding (QSV, NVENC, VAAPI) whenever available to reduce load.

Add Channel dialog with codec, bitrate, and audio settings

Add Channel — select source, codec, bitrate, audio, and viewer limit

Alpha

Edit Channel dialog showing WHIP output configuration for re-streaming to CDNs

WHIP Outputs — push channels to remote WHIP endpoints (CDNs, streaming platforms)

5 Start & Watch

Click the Start button on your channel. The gateway begins encoding and you can:

Preview — Click the eye icon on the channel card to watch in the dashboard
Watch Link — Copy the watch URL and send it to anyone. Opens a full-screen player.
Multiview — Click the grid icon in the header to open a multi-channel monitoring wall

Live channel preview with test pattern stream

Preview — live video playing directly in the dashboard

Watch URL Format

https://<host>/watch/<channelId>

Share this link with viewers — no login required

Watch page — full-screen player with LIVE indicator, shareable link

Multiview grid showing 2x2 channel layout

Multiview — 2x2 monitoring wall (1x1, 3x3, 4x4 also available)

6 Remote Access (Cloudflare Tunnel)

To share streams with viewers outside your local network without opening firewall ports:

Go to Settings → Cloudflare
Click Enable Cloudflare Tunnel and save
A public URL (*.trycloudflare.com) is generated automatically — no account required
Share the tunnel URL with remote viewers

How it works: Remote viewers connect through the Cloudflare tunnel. Since WebRTC UDP cannot traverse HTTP tunnels, the gateway automatically switches remote viewers to a WebSocket media relay — no configuration needed.

Persistent Tunnel (Optional)

For a permanent URL with your own domain:

Create a tunnel in the Cloudflare Zero Trust dashboard
Point the tunnel to http://localhost:5290
Paste the tunnel token in Settings → Cloudflare → Tunnel Token

Cloudflare TURN Relay (Optional)

For improved WebRTC connectivity behind strict firewalls:

In the Cloudflare dashboard, go to Calls → TURN Keys
Create a key and copy the Key ID and API Token
Paste into Settings → Cloudflare → TURN Relay

7 Email Alerts (Optional)

Get notified when channels fail or OMT sources disappear. Go to Settings → Email Alerts:

Enter your SMTP server details (host, port, username, password)
Set a sender address and recipient list
Enable Channel failure and/or Source loss triggers
Click Send Test Email to verify

8 License

The gateway starts a 30-day trial on first boot. During the trial, all features are fully available.

View your trial status in Settings → License
A warning banner appears on the dashboard when 7 days or fewer remain
When the trial expires, existing channels stop and new ones cannot be started
Enter a license key in Settings → License → Activate to continue

Monthly

£15/mo

Cancel anytime

Lifetime

£250

One-time payment · 1 year of updates

Buy Lifetime

Already purchased? Retrieve your license key.

API Reference

The gateway exposes a REST API at https://<host>/api/ for programmatic control.

Channels

Method	Endpoint	Description
`GET`	`/api/channels`	List all channels with status and stats
`POST`	`/api/channels`	Create a new channel
`GET`	`/api/channels/{id}`	Get channel details
`PUT`	`/api/channels/{id}`	Update channel settings
`DELETE`	`/api/channels/{id}`	Delete a channel
`POST`	`/api/channels/{id}/start`	Start encoding
`POST`	`/api/channels/{id}/stop`	Stop encoding
`GET`	`/api/channels/{id}/log`	FFmpeg encoder log
`POST`	`/api/channels/start-all`	Start all enabled channels
`POST`	`/api/channels/stop-all`	Stop all channels

Sources & System

Method	Endpoint	Description
`GET`	`/api/sources`	List discovered OMT sources
`GET`	`/api/health`	System health and status
`GET`	`/api/settings`	Current settings
`PUT`	`/api/settings`	Update settings
`GET`	`/api/license`	License / trial status
`POST`	`/api/license/activate`	Activate a license key
`GET`	`/api/ice-servers`	ICE/TURN servers for WebRTC

WHEP (WebRTC Playback)

Method	Endpoint	Description
`POST`	`/whep/{channelId}`	WHEP offer — send SDP, receive answer
`PATCH`	`/whep/{channelId}/{sessionId}`	ICE trickle candidate
`DELETE`	`/whep/{channelId}/{sessionId}`	End WHEP session

WHIP Outputs ALPHA

Push channels to remote WHIP ingest endpoints. Configured per-channel from the web UI or via API.

Method	Endpoint	Description
`GET`	`/api/channels/{id}/whip-outputs`	List WHIP outputs for a channel
`POST`	`/api/channels/{id}/whip-outputs`	Add a WHIP output
`PUT`	`/api/channels/{id}/whip-outputs/{outputId}`	Update a WHIP output
`DELETE`	`/api/channels/{id}/whip-outputs/{outputId}`	Remove a WHIP output
`POST`	`/api/channels/{id}/whip-outputs/{outputId}/start`	Start pushing to endpoint
`POST`	`/api/channels/{id}/whip-outputs/{outputId}/stop`	Stop pushing to endpoint

Network & Ports

Port	Protocol	Direction	Purpose
443	TCP	Inbound	HTTPS (Caddy reverse proxy)
80	TCP	Inbound	HTTP redirect + CA cert download
5290	TCP	Internal	Gateway API + Web UI
7800	TCP	Internal	WHEP signalling (also exposed on 443)
5353	UDP	LAN	DNS-SD / mDNS (OMT source discovery)
10000–10100	UDP	Inbound	WebRTC media (if port range configured)

LAN-only use: No port forwarding needed. Viewers on the same network connect directly.
Remote access: Use Cloudflare Tunnel (no open ports) or forward UDP 10000–10100 + TCP 443.

SSH Access

The appliance has SSH enabled for administration:

ssh omt-admin@<appliance-ip>

Default password: omtwhep — change this after first login

Useful commands:

omt-show-ip — Display dashboard URL, API endpoint, version
sudo systemctl status omt-whep-gateway — Check service status
sudo systemctl restart omt-whep-gateway — Restart the gateway
sudo journalctl -u omt-whep-gateway -f — Follow live logs

Troubleshooting

No sources found? Ensure the OMT encoder is on the same network/subnet. Check that UDP 5353 (mDNS) is not blocked. The appliance uses Avahi for DNS-SD discovery.
Channel starts but video is black? Check the FFmpeg log (click the log icon on the channel card). Common causes: wrong source selected, source not actively sending.
High CPU usage? Switch to hardware encoding (VAAPI, QSV, NVENC) if you have a supported GPU. Lower the bitrate or increase the preset speed.
Viewers see "ICE gathering timeout"? This happens when WebRTC UDP is blocked. The player automatically falls back to WebSocket relay after 4 seconds. If using Cloudflare Tunnel, this is expected behaviour.
Blank screen on watch page? The browser WebSocket relay fallback should activate automatically. Check that the channel is running (green status). Try refreshing.
Certificate warning in browser? Install the CA certificate: visit http://<ip>/api/ca.crt and add it to your trusted roots. Or switch to Let's Encrypt in TLS settings.
Audio not working? Check that audio is enabled in the channel settings. The player starts muted by default — click the unmute button.
"Trial expired" error? Enter a license key in Settings → License, or contact contact@sebiulabs.co.uk.
Channel keeps failing/restarting? Check the FFmpeg log for errors. Common issues: source disconnected, GPU driver not installed, codec not supported by hardware.
Can't access dashboard remotely? Set up Cloudflare Tunnel in Settings, or ensure TCP 443 is forwarded to the appliance.

System Requirements

	Minimum	Recommended
CPU	x86_64, 4 cores	x86_64, 6–8+ cores
RAM	4 GB	8 GB+
Disk	8 GB	16 GB+ SSD
Network	100 Mbps Ethernet	1 Gbps Ethernet
GPU / HW Encode	None (software encode)	Intel Quick Sync, AMD AMF, or NVIDIA NVENC

Recommended Hardware

Any modern x86_64 device with hardware video encode/decode and at least 6 CPU cores. Good choices include:

Intel NUC (11th gen or newer) — built-in Quick Sync provides excellent H.264/HEVC/AV1 hardware encoding in a compact, low-power form factor. Ideal for on-site deployments.
Mini PCs (Beelink, MinisForum, etc.) — Intel 12th/13th/14th gen or AMD Ryzen 6000+ with 6–8 cores and integrated GPU for hardware encoding.
Small form-factor servers (Dell OptiPlex Micro, HP ProDesk Mini, Lenovo ThinkCentre Tiny) — Intel vPro CPUs with Quick Sync, enterprise-grade reliability.
Virtual machines (Proxmox VE (open source), VMware ESXi, Hyper-V) — allocate 6 cores / 12 vCPUs and 8 GB RAM. GPU passthrough supported for hardware encoding.

Tip: Intel Quick Sync (VAAPI/QSV) offers the best performance-per-watt for 1–8 channel deployments. A modern Intel NUC with a 12th gen+ CPU can handle multiple simultaneous transcodes with minimal CPU load, leaving headroom for FFmpeg and the WHEP gateway.

Note: AV1 encoding is significantly more CPU-intensive than H.264 or HEVC. If you plan to run multiple channels with AV1, you will need more CPU cores and a processor with hardware AV1 encode support (Intel 12th gen+, AMD Ryzen 7000+).

Hardware Encoding Support

GPU	API	Codecs
Intel (6th gen+)	VAAPI / QSV	H.264, HEVC, AV1 (12th gen+)
AMD (RX 400+)	VAAPI / AMF	H.264, HEVC, AV1 (RX 7000+)
NVIDIA (GTX 10xx+)	NVENC	H.264, HEVC, AV1 (RTX 40xx+)

Need Help?

Website: sebiulabs.co.uk