diff --git a/clusters/base/apps/jitsi/helmrelease.yaml b/clusters/base/apps/jitsi/helmrelease.yaml
index cc20daf..8fd4b0d 100644
--- a/clusters/base/apps/jitsi/helmrelease.yaml
+++ b/clusters/base/apps/jitsi/helmrelease.yaml
@@ -37,7 +37,7 @@ spec:
             hosts:
               - v.aggtaa.com
 
-    # media traffic: UDP 10000 must be forwarded from the WAN router to the dmz pool ip (10.0.64.7)
+    # media traffic: UDP 10000 must be forwarded from the WAN router to the JVB service ip (kubectl get svc -n video)
     jvb:
       UDPPort: 10000
       publicIPs:
@@ -50,11 +50,11 @@ spec:
   postRenderers:
     - kustomize:
         patches:
-          # pin the JVB service to the dmz pool (see infra/metallb/config.yaml)
+          # dmz-pool has a single ip held by traefik, so use the dedicated public-ports-pool (see infra/metallb/config.yaml)
           - target:
               kind: Service
               name: jitsi-jitsi-meet-jvb
             patch: |
               - op: add
-                path: /metadata/labels/loadBalancerPool
-                value: dmz
+                path: /metadata/annotations/metallb.io~1address-pool
+                value: public-ports-pool
diff --git a/clusters/base/infra/metallb/config.yaml b/clusters/base/infra/metallb/config.yaml
index b4d1518..3ef9850 100644
--- a/clusters/base/infra/metallb/config.yaml
+++ b/clusters/base/infra/metallb/config.yaml
@@ -10,7 +10,8 @@ spec:
     - 10.0.64.6/32
     # exclude 10.0.64.7, its in dmz-pool
     # exclude 10.0.64.8, its in mqtt-pool
-    - 10.0.64.9-10.0.64.19
+    # exclude 10.0.64.9, its in public-ports-pool
+    - 10.0.64.10-10.0.64.19
   autoAssign: true
   serviceAllocation:
     serviceSelectors:
@@ -62,6 +63,19 @@ spec:
       - matchLabels:
           loadBalancerPool: mqtt
 ---
+# ip for services that need individual ports forwarded from WAN router (e.g. jitsi jvb udp)
+# not auto-assigned: a service gets it only with an explicit annotation
+# metallb.io/address-pool: public-ports-pool
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: public-ports-pool
+  namespace: metallb-system
+spec:
+  addresses:
+    - 10.0.64.9/32
+  autoAssign: false
+---
 apiVersion: metallb.io/v1beta1
 kind: L2Advertisement
 metadata:
@@ -73,3 +87,4 @@ spec:
     - dmz-pool
     - mqtt-pool
     - nfs-pool
+    - public-ports-pool