WebRTC TURN Server Setup: The Complete Production Guide (2026)

# Update package index and install coturn
sudo apt update && sudo apt install -y coturn

# Enable the coturn service (disabled by default after install)
sudo nano /etc/default/coturn
# Set: TURNSERVER_ENABLED=1

# Verify installation
turnserver --version
# Should output: coturn-4.6.x (or higher)

# Check systemd service
sudo systemctl status coturn

sudo cp /etc/turnserver.conf /etc/turnserver.conf.bak
sudo truncate -s 0 /etc/turnserver.conf

# ─── Network ──────────────────────────────────────────────────
listening-port=3478
tls-listening-port=5349
# Also listen on 443 for firewalls that block 3478/5349
alt-listening-port=80
alt-tls-listening-port=443

# Your server's public static IP
listening-ip=0.0.0.0
external-ip=YOUR_PUBLIC_IP

# Relay port range — must match firewall rules
min-port=49152
max-port=65535

# ─── Authentication ────────────────────────────────────────────
# Use time-limited credentials (no static user/pass)
use-auth-secret
static-auth-secret=YOUR_SECRET_32_CHAR_HEX
realm=turn.YOUR_DOMAIN.com

# ─── TLS / DTLS ────────────────────────────────────────────────
cert=/etc/letsencrypt/live/turn.YOUR_DOMAIN.com/fullchain.pem
pkey=/etc/letsencrypt/live/turn.YOUR_DOMAIN.com/privkey.pem
cipher-list="ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"
no-sslv3
no-tlsv1
no-tlsv1_1
# Allow TLSv1.2 and TLSv1.3 only

# ─── Protocols ─────────────────────────────────────────────────
# Disable STUN-only allocation (require TURN auth)
no-stun
# Enable UDP, TCP, and TCP-connect-method
no-multicast-peers

# ─── Logging ───────────────────────────────────────────────────
log-file=/var/log/turnserver.log
verbose
# For debugging ICE issues, enable full verbose:
# Verbose

# ─── Redis session store (optional but recommended) ────────────
# redis-userdb="ip=127.0.0.1 dbname=2 connect_timeout=30"

# ─── Performance ──────────────────────────────────────────────
# Max allocations per user (prevent abuse)
user-quota=100
# Total server allocation limit
total-quota=30000
# Idle session timeout in seconds
stale-nonce=600
no-stdout-log
syslog

# Install certbot
sudo apt install -y certbot

# Obtain certificate (standalone mode — coturn must be stopped)
sudo systemctl stop coturn
sudo certbot certonly --standalone -d turn.YOUR_DOMAIN.com   --email admin@YOUR_DOMAIN.com --agree-tos --no-eff-email

# Certificate is at:
# /etc/letsencrypt/live/turn.YOUR_DOMAIN.com/fullchain.pem
# /etc/letsencrypt/live/turn.YOUR_DOMAIN.com/privkey.pem

# Allow coturn to read Let's Encrypt certificates
sudo chown -R turnserver:turnserver /etc/letsencrypt/
sudo chmod 750 /etc/letsencrypt/live /etc/letsencrypt/archive

# Start coturn
sudo systemctl start coturn
sudo systemctl enable coturn

# Auto-renew: add pre/post hooks in /etc/letsencrypt/renewal-hooks/
# pre: systemctl stop coturn
# post: systemctl start coturn

sudo ss -tulpn | grep turnserver
# Expected output:
# udp  UNCONN  0  0  0.0.0.0:3478   0.0.0.0:*  users:(("turnserver",...))
# udp  UNCONN  0  0  0.0.0.0:5349   0.0.0.0:*  users:(("turnserver",...))
# tcp  LISTEN  0  128 0.0.0.0:3478  0.0.0.0:*  users:(("turnserver",...))
# tcp  LISTEN  0  128 0.0.0.0:5349  0.0.0.0:*  users:(("turnserver",...))
# tcp  LISTEN  0  128 0.0.0.0:443   0.0.0.0:*  users:(("turnserver",...))

# Test STUN from another machine:
# stunclient turn.YOUR_DOMAIN.com 3478

# Requires nginx compiled with --with-stream_ssl_preread_module
stream {
    map $ssl_preread_server_name $backend {
        turn.YOUR_DOMAIN.com  127.0.0.1:5349;
        www.YOUR_DOMAIN.com   127.0.0.1:8443;
        default               127.0.0.1:8443;
    }

    server {
        listen 443;
        proxy_pass $backend;
        ssl_preread on;
        proxy_buffer_size 16k;
        proxy_timeout 3600s;
        proxy_connect_timeout 5s;
    }
}

# STUN/TURN standard ports
sudo ufw allow 3478/udp comment "STUN/TURN UDP"
sudo ufw allow 3478/tcp comment "TURN TCP"

# TURNS (TURN over TLS/DTLS)
sudo ufw allow 5349/udp comment "TURNS UDP (DTLS)"
sudo ufw allow 5349/tcp comment "TURNS TCP (TLS)"

# TURN on 443 for firewall bypass
sudo ufw allow 443/tcp comment "TURNS TCP on 443"
sudo ufw allow 443/udp comment "TURNS UDP on 443"

# !! CRITICAL: Relay media port range !!
# This is what allows actual media to flow through TURN
sudo ufw allow 49152:65535/udp comment "TURN relay media ports"

# Apply and verify
sudo ufw enable
sudo ufw status verbose | grep -E "(3478|5349|443|49152)"

const crypto = require('crypto');

function generateTURNCredentials(secret, ttlSeconds = 86400) {
  const timestamp = Math.floor(Date.now() / 1000) + ttlSeconds;
  const username = `${timestamp}:user-${Math.random().toString(36).slice(2)}`;
  const hmac = crypto.createHmac('sha1', secret);
  hmac.update(username);
  const credential = hmac.digest('base64');
  return { username, credential };
}

// In your API endpoint:
app.get('/api/turn-credentials', (req, res) => {
  const { username, credential } = generateTURNCredentials(
    process.env.TURN_SECRET
  );
  res.json({
    iceServers: [
      { urls: 'stun:stun.l.google.com:19302' },
      {
        urls: [
          'turn:turn.YOUR_DOMAIN.com:3478?transport=udp',
          'turn:turn.YOUR_DOMAIN.com:3478?transport=tcp',
          'turns:turn.YOUR_DOMAIN.com:5349?transport=tcp',
          'turns:turn.YOUR_DOMAIN.com:443?transport=tcp',  // firewall bypass
        ],
        username,
        credential,
      },
    ],
  });
});

// Fetch credentials from your backend
const { iceServers } = await fetch('/api/turn-credentials').then(r => r.json());

const pc = new RTCPeerConnection({
  iceServers,
  iceTransportPolicy: 'all',  // 'relay' to force TURN for testing
  bundlePolicy: 'max-bundle',
  rtcpMuxPolicy: 'require',
});

// Monitor ICE candidate types to verify TURN is working
pc.addEventListener('icecandidate', (e) => {
  if (!e.candidate) return;
  const { candidate } = e.candidate;
  const type = candidate.includes('relay') ? '🔄 RELAY (TURN)'
             : candidate.includes('srflx') ? '🌐 STUN'
             : '🏠 HOST';
  console.log(`ICE candidate: ${type}`, candidate);
});

// Force TURN only to test your TURN server:
// Change iceTransportPolicy to 'relay'

# Install Redis
sudo apt install -y redis-server

# Secure Redis (bind to localhost only)
sudo nano /etc/redis/redis.conf
# Set: bind 127.0.0.1 ::1
# Set: requirepass YOUR_REDIS_PASSWORD

sudo systemctl restart redis-server

# Update turnserver.conf — uncomment the Redis line:
# redis-userdb="ip=127.0.0.1 port=6379 dbname=2 password=YOUR_REDIS_PASSWORD connect_timeout=30"

# Restart coturn
sudo systemctl restart coturn

# Verify Redis is being used (watch keys appear during a call)
redis-cli -a YOUR_REDIS_PASSWORD MONITOR

# ─── Network buffer sizes ─────────────────────────────────────
# Default coturn: 212992. Increase for high concurrency.
net.core.rmem_max=26214400
net.core.wmem_max=26214400
net.core.rmem_default=26214400
net.core.wmem_default=26214400
net.core.netdev_max_backlog=65536

# ─── UDP socket buffers ────────────────────────────────────────
net.ipv4.udp_rmem_min=8192
net.ipv4.udp_wmem_min=8192

# ─── Connection tracking (for TCP TURN sessions) ──────────────
net.netfilter.nf_conntrack_max=524288
net.netfilter.nf_conntrack_udp_timeout=300
net.netfilter.nf_conntrack_udp_timeout_stream=300

# ─── File descriptor limits ───────────────────────────────────
fs.file-max=2097152

# Apply immediately:
# sudo sysctl -p /etc/sysctl.d/99-coturn.conf

# Also update systemd service limits:
# /etc/systemd/system/coturn.service.d/limits.conf
# [Service]
# LimitNOFILE=1048576
# LimitNPROC=65536