TURN for WebRTC: when viewers sit behind strict NAT and firewalls
A WebRTC viewer that never starts playing is almost always behind a network that blocks UDP or only allows web traffic. The fix is in layers: let the browser reach the media server over UDP, fall back to TCP on the media port, and as a last resort relay through a TURN server on port 443 over TLS. Give each browser short-lived TURN credentials, never the shared secret.
How WebRTC finds a path
Both sides gather candidate addresses (ICE candidates): their local address, their public address as seen by a STUN server, and relay addresses on a TURN server. They try pairs until one carries traffic. With a media server on a public address, the viewer's browser usually reaches it directly over UDP and no relay is needed.
Where it fails
- UDP blocked: common on corporate and some hotel or school networks.
- Only web ports allowed: outbound traffic restricted to 80 and 443, sometimes through an inspecting proxy.
- Symmetric NAT on both ends: for peer-to-peer; rarely a problem when one side is a public server.
Layer 1: TCP to the media server
WebRTC can carry media over TCP to the same port. That covers networks that block UDP but allow outbound TCP to other ports. Latency rises a little because TCP waits for lost packets, but the viewer gets a picture.
Layer 2: TURN over TLS on 443
When only web traffic leaves the network, the browser connects to a TURN server on port
443 over TLS (turns:), which looks like ordinary https. The TURN server
relays every packet to the media server. coturn is the common open-source choice; hosted
TURN services also work.
Credentials that expire
A TURN server is an open relay to anyone holding its credentials, so never put a permanent
password in a web page. The standard TURN REST scheme gives each browser a username of
expiry-timestamp:name and a password of base64(HMAC-SHA1(shared secret,
username)). The TURN server checks it with the same secret; the secret itself never leaves
your server, and the credential stops working when it expires.
In creekX: WebRTC uses port 8189 over UDP with TCP on the same port as
fallback. For networks that allow only web traffic, set the TURN addresses, a name and
the TURN server's shared secret in the server's environment
(PERPETUA_LIVE_TURN_URLS, _USERNAME, _SECRET);
each browser then gets its own credential that expires with its pass. See
what is a WebRTC server.
Frequently asked questions
Do I always need a TURN server?
No. A media server with a public address and a TCP fallback reaches most viewers directly. TURN is for networks that allow only web traffic through a proxy or firewall.
What is the difference between STUN and TURN?
STUN tells a browser its public address so it can connect directly. TURN relays all the media when no direct path works.
How much bandwidth does TURN use?
All of it: every relayed viewer’s video passes through the TURN server, so size it like a media server for those viewers.