diff --git a/galene.go b/galene.go
index 842c520..8a25d85 100644
--- a/galene.go
+++ b/galene.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"flag"
+	"fmt"
 	"log"
 	"os"
 	"os/signal"
@@ -20,6 +21,7 @@ import (
 
 func main() {
 	var cpuprofile, memprofile, mutexprofile, httpAddr, dataDir string
+	var udpRange string
 
 	flag.StringVar(&httpAddr, "http", ":8443", "web server `address`")
 	flag.StringVar(&webserver.StaticRoot, "static", "./static/",
@@ -40,6 +42,8 @@ func main() {
 		"store memory profile in `file`")
 	flag.StringVar(&mutexprofile, "mutexprofile", "",
 		"store mutex profile in `file`")
+	flag.StringVar(&udpRange, "udp-range", "",
+		"UDP port `range`")
 	flag.BoolVar(&group.UseMDNS, "mdns", false, "gather mDNS addresses")
 	flag.BoolVar(&ice.ICERelayOnly, "relay-only", false,
 		"require use of TURN relays for all media traffic")
@@ -47,6 +51,21 @@ func main() {
 		"built-in TURN server `address` (\"\" to disable)")
 	flag.Parse()
 
+	if udpRange != "" {
+		var min, max uint16
+		n, err := fmt.Sscanf(udpRange, "%v-%v", &min, &max)
+		if err != nil {
+			log.Printf("UDP range: %v", err)
+			os.Exit(1)
+		}
+		if n != 2 || min <= 0 || max <= 0 || min > max {
+			log.Printf("UDP range: bad range")
+			os.Exit(1)
+		}
+		group.UDPMin = min
+		group.UDPMax = max
+	}
+
 	if cpuprofile != "" {
 		f, err := os.Create(cpuprofile)
 		if err != nil {
diff --git a/group/group.go b/group/group.go
index 54e55ce..e6cbb74 100644
--- a/group/group.go
+++ b/group/group.go
@@ -18,6 +18,7 @@ import (
 
 var Directory string
 var UseMDNS bool
+var UDPMin, UDPMax uint16
 
 var ErrNotAuthorised = errors.New("not authorised")
 
@@ -247,6 +248,11 @@ func APIFromCodecs(codecs []webrtc.RTPCodecCapability) (*webrtc.API, error) {
 			continue
 		}
 	}
+
+	if UDPMin > 0 && UDPMax > 0 {
+		s.SetEphemeralUDPPortRange(UDPMin, UDPMax)
+	}
+
 	return webrtc.NewAPI(
 		webrtc.WithSettingEngine(s),
 		webrtc.WithMediaEngine(&m),