codex.live-media-relay.udp-port-min must not exceed udp-port

Error message

codex.live-media-relay.udp-port-min must not exceed udp-port-max

What it means

Validation error for codex.live-media-relay: udp-port-min is greater than udp-port-max. An inverted range cannot reserve ports for sessions, so Validate() rejects it. Note the follow-on check: when the range is valid it must also contain at least 2 ports per configured session.

Source

Thrown at internal/config/codex_live.go:80

	return DefaultCodexLiveMediaMaxSessions
}

// Validate verifies the Codex Live media relay configuration.
func (c CodexLiveMediaRelayConfig) Validate() error {
	if !c.Enabled {
		return nil
	}
	if c.MaxSessions < 0 {
		return errors.New("codex.live-media-relay.max-sessions must not be negative")
	}
	if publicIP := strings.TrimSpace(c.PublicIP); publicIP != "" && net.ParseIP(publicIP) == nil {
		return fmt.Errorf("codex.live-media-relay.public-ip is invalid: %q", publicIP)
	}
	if (c.UDPPortMin == 0) != (c.UDPPortMax == 0) {
		return errors.New("codex.live-media-relay UDP port minimum and maximum must both be set")
	}
	if c.UDPPortMin > c.UDPPortMax {
		return errors.New("codex.live-media-relay.udp-port-min must not exceed udp-port-max")
	}
	if c.UDPPortMin != 0 {
		availablePorts := int(c.UDPPortMax) - int(c.UDPPortMin) + 1
		requiredPorts := c.EffectiveMaxSessions() * 2
		if availablePorts < requiredPorts {
			return fmt.Errorf("codex.live-media-relay UDP range requires at least %d ports for %d sessions", requiredPorts, c.EffectiveMaxSessions())
		}
	}
	for serverIndex, server := range c.ICEServers {
		if len(server.URLs) == 0 {
			return fmt.Errorf("codex.live-media-relay.ice-servers[%d].urls is required", serverIndex)
		}
		for _, rawURL := range server.URLs {
			parsed, errParse := url.Parse(strings.TrimSpace(rawURL))
			if errParse != nil || parsed.Scheme == "" {
				return fmt.Errorf("codex.live-media-relay.ice-servers[%d] contains an invalid URL", serverIndex)
			}
			switch strings.ToLower(parsed.Scheme) {

View on GitHub (pinned to 78f0c4079e)

Solutions

Swap the values so udp-port-min <= udp-port-max
Confirm the corrected range spans at least 2 * EffectiveMaxSessions() ports
Confirm the ports are actually free/open on the host firewall

Example fix

# before
codex:
  live-media-relay:
    enabled: true
    udp-port-min: 50100
    udp-port-max: 50000
# after
codex:
  live-media-relay:
    enabled: true
    udp-port-min: 50000
    udp-port-max: 50100

Defensive patterns

Strategy: validation

Validate before calling

r := cfg.Codex.LiveMediaRelay
if r.Enabled && r.UDPPortMin != 0 && r.UDPPortMin > r.UDPPortMax {
    return fmt.Errorf("udp range inverted: min=%d max=%d", r.UDPPortMin, r.UDPPortMax)
}

Try / catch

if err := relayCfg.Validate(); err != nil {
    if strings.Contains(err.Error(), "must not exceed udp-port-max") {
        return errors.New("config fix: swap udp-port-min/udp-port-max so min <= max")
    }
    return err
}

Prevention

Double-check range ordering after any manual config edit
Reserve at least 2 * max-sessions ports in the range and open them in the firewall

When it happens

Trigger: Config with enabled: true where udp-port-min > udp-port-max (e.g. 50100 / 50000).

Common situations: Swapped values when hand-editing config; copy-paste from examples with different orderings.

Related errors

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/0f41253b3da4ef28. Report an issue: GitHub.