How can we return turn1.example.com in the relay candidate response

[navinkumarr]

We use below sample configuration to make RTC Connection

var iceServers = [{credential: "cred", url: "turn1.example.com", username: "user"}]
var pc  = new RTCPeerConnection({'iceServers': iceServers});

From the coturn config, we use external-ip e.g. XX.XXX.XXX.XXX configuration to return the relay candidate

sdpMid: video, sdpMLineIndex: 0, candidate: candidate:1981056635 1 udp 16787967 XX.XXX.XXX.XXX 59267 typ relay raddr YYY.YYY.YYY.Y rport 31766 generation 0 ufrag CdMl network-cost 999

The problem that I am facing is of whitelisting. For example, *.example.com and TURN/STUN ports (49152-65535, 3478 / 5349) are whitelisted on the firewall for outgoing requests. So ideally webrtc connection should work but we are seeing that connection does not happen.

As per my understanding, After gathering the candidates via turn1.example.com while making the connection (which happens using URL as per config) via the turn server for streaming we are using the external-ip received in ice candidate list and hence just whitelisting *.example.com does not work.

My question is that is my understanding of the problem correct and if yes, then how can we solve this ?

[eakraly]

Hi @navinkumarr
Right, firewalls are never easy.

I cannot think of an easy solution - here are a few things that come to mind

• To have an additional mechanism that will update firewall config with IP addresses of TURN servers. For example a job that would run every X hours, resolve address of TURN server(s) and update firewall rules.

• If your FW always allows HTTPS (TLS over 443) then you can force relay to use TURN over TLS (use following as iceCandidate: turns:turn1.example.com:443). This will enable relay over TLS to 443 which will look like HTTPS to most firewalls but may degrade connection quality

Hope that helps

[navinkumarr]

Hi @eakraly , Thank you for the response.

Just wanted clarity on one thing. Do we need to use below setting in iceCandidate or in iceServer ?

iceCandidate: turns:turn1.example.com:443

[eakraly]

iceServer - my bad