Question:

[marek22k]

Hello,

i have a question about the STUN coturn server.

When I send a classic STUN request with response address attribute to a
coturn server, it sends a Binding Response with a Reflected from
attribute as response, but not to the address specified in response
address attributes. My question is if this is on purpose? Is it
possible to set in the configuration file? Is it because of the server
I used?

I attached a PCAP file which contains request and response.
My expected behavior from the Coturn server would have been that it
responds on port 40000 and not on the port from which it received the
request.
stun.pdf
PCAP: https://paste.i2pd.xyz/?80a32fbdf02f18b1#6AdThYAHqPhgo8RdtYdTGMTjMSCbPkwg7Jx7VwyS7QEr

[eakraly]

Without looking into the code - my guess is that is DDoS protection.
If you can send binding request with a different response address attribute and STUN server respects that then this is a mechanism for (STUN) Reflection/Amplification

And we do not want that.