STUN - TCP instead UDP Connection?

1,093 views
Skip to first unread message

Marco Unso

unread,
Jan 27, 2021, 4:35:49 AM1/27/21
to BigBlueButton-Setup
Hello,

in order to be able to use BBB video conferencing even through restrictive firewalls, we have installed a Coturn STUN/TURN server.

The STUN service on the STUN/TURN server listens on TCP/UDP 80, the TURN service listens on TCP/UDP 443:

tcp        0      0 100.xx.xx.xx:80          0.0.0.0:*               LISTEN
udp        0      0 100.xx.xx.xx:80          0.0.0.0:*

tcp        0      0 100.xx.xx.xx:443         0.0.0.0:*               LISTEN
udp        0      0 100.xx.xx.xx:443         0.0.0.0:*


The documentation for BBB says that for the TURN protocol, I can specify that the connection to TUR should be made over a TCP connection:
/usr/share/bbb-web/WEB-INF/classes/spring/turn-stun-servers.xml
        ...
        <constructor-arg index="1" value="turns:turn.xxx.en:443?transport=tcp"/>
        ...

How can I specify for the STUN protocol to connect over TCP for this? If I specify the parameter "?transport=tcp" after port 80, this has no effect.  I have tried the following variants

                <constructor-arg index="0" value="stun:turn.thillm.de:80"/>                        --> Connection over UDP:80
                <constructor-arg index="0" value="stun:turn.thillm.de:80?transport=tcp"/>        --> Connection also over UDP:80?!?

The restrective firewall blocks the UDP port 80 outgoing (TCP 80, so HTTP is allowed through).
Does anyone have a tip for me how to change the connection to the coturn server from UDP 80 to TCP 80?

Thanks a lot for your effort!

Greetings, Marco


sd...@distancelearning.cloud

unread,
Jan 27, 2021, 8:47:32 AM1/27/21
to bigbluebu...@googlegroups.com

Can you put the stun.turn server on edge of network with its own public interface, or run a cheap $40 vm in digital ocean?

 

I have seen a few universities try to route everything through their campus firewall appliances, and all the media connections for video/audio/screenshare caused some major issues at scale.

Might work for a few users, but scale it to 1000, the appliance could not handle.

 

The standard listening port number for a STUN server is 3478 for UDP and TCP, and 5349 for TLS,  assume you have to make some config changes in coturn config have not tried.

 

There was a post earlier this year, where someone got both stun/turn on 443 and disabled encryption. Would have to search dev or setup group for it.

 

Regards,

Stephen

--
You received this message because you are subscribed to the Google Groups "BigBlueButton-Setup" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bigbluebutton-s...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/bigbluebutton-setup/23a8b0c1-b443-4d45-bbbd-8852a7150f85n%40googlegroups.com.

basisbit

unread,
Jan 28, 2021, 5:44:17 AM1/28/21
to BigBlueButton-Setup
@Stephen: STUN/TURN/TURNS on tcp/443 is the default suggested setup. No need to search any mailing list content.
@Marco: I'd suggest you to strictly follow the suggested configuration that is documented at https://docs.bigbluebutton.org/2.2/setup-turn-server.html#configure-coturn , except comment out the `lt-cred-mech` line.

Fred Dixon

unread,
Jan 28, 2021, 7:29:09 AM1/28/21
to BigBlueButton-.
Hi basisbit,

> I'd suggest you to strictly follow the suggested configuration that is documented at https://docs.bigbluebutton.org/2.2/setup-turn-server.html#configure-coturn , except comment out the `lt-cred-mech` line.

We've updated the docs at 


which should now be equivalent to setup using bbb-install.sh


If you see any errors in the docs, please let us know.


From what we've determined the `lt-cred-mech` is stated in the docs as needed WebRTC, see


However, we did some testing and removed it, and the TURN server still worked, so it might be that this is no longer needed.

Regards,... Fred



--
BigBlueButton Developer

Like BigBlueButton?  Tweet us at @bigbluebutton

sd...@distancelearning.cloud

unread,
Jan 28, 2021, 7:39:08 AM1/28/21
to bigbluebu...@googlegroups.com

The docs, and config file example, and stun test all show 3478 in the link  you provided.

 

So what your saying is turn will also answer on 443 as well even though 3478 is configured?

 

Let me build new one on 20.04 per bbb-install and compare against current running.

Marco Unso

unread,
Jan 29, 2021, 2:46:18 AM1/29/21
to BigBlueButton-Setup
Verry strange...

i change the turn conf, but the Client still try connect to UDP:80:

listening-port=80
tls-listening-port=443

listening-ip=100.xx.xx.xx
relay-ip=100.xx.xx.xx

min-port=32769
max-port=65535
verbose

fingerprint
lt-cred-mech
use-auth-secret
static-auth-secret=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
realm=turn.xxx.de

cert=/etc/coturn/certs/turn.xxx.de.fullchain.pem
pkey=/etc/coturn/certs/turn.xxx.de.privkey.pem
# From https://ssl-config.mozilla.org/ Intermediate, openssl 1.1.0g, 2020-01
cipher-list="ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"
dh-file=/etc/coturn/certs/dhparam4096.pem

keep-address-family
no-cli
no-tlsv1
no-tlsv1_1

log-file=/var/log/coturn/coturn.log

When I block the UDP-Port 80 in my Firewall outgoing i get error 1020 an see in my Firewall-Log, that the Client try to connect to the server over UDP:80.

The inital-Connection to the turn-server come from the Client, and the client connect to the turn-Server, because I changed the Destination-Server in the file /usr/share/bbb-web/WEB-INF/classes/spring/turn-stun-servers.xml. So i think, that the bbb-Server must say the client, that he schould connect over TCP, instead of UDP? Am I wrong in my thinking?

Ps.: sorry for my bad English ;-)

Marco Unso

unread,
Feb 7, 2021, 3:46:53 AM2/7/21
to BigBlueButton-Setup
Hi,

sorry, but the error is still the same. The Coturn-Server listen for STUN on UDP and TCP 80, but the Client try only to connect over UDP Port 80. I Think, the problem is the BBB-Config. Why I cannot add the parmeter " transport=tcp" for the STUN-Server? Only for Turn-Server the TCP-flag works fine.

Cheers, Marco

Philipp Memmel

unread,
Feb 7, 2021, 4:17:21 AM2/7/21
to bigbluebu...@googlegroups.com
IMO the problem isn't the config. If you configure
/usr/share/bbb-web/WEB-INF/classes/spring/turn-stun-servers.xml like the
documentation is saying there shouldn't be any problem.

AFAIK STUN is a purely UDP based standard which is only used to find out
the current networking setup (NAT or no NAT, what kind of NAT etc.). So
it's obvious that you can't tell STUN to use TCP.

If client/server cannot figure out their network configuration via STUN
because UDP is blocked for example they should fallback to using TURN
where you then have the possibility to use TCP instead of UDP. What TURN
server to use on which port with which protocol is configured in
/usr/share/bbb-web/WEB-INF/classes/spring/turn-stun-servers.xml, just
use the standard documentation for this. This is also the config that is
being sent to the client by the BBB server, you got that right, yes.

This should work well without any problems. If I shutdown my firewall
completely to nothing except 80/443 TCP and 53 UDP (for dns access) I
can access my bigbluebutton servers without any problems.

You can check if your TURN server is working with
https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice/

Just use URL in
/usr/share/bbb-web/WEB-INF/classes/spring/turn-stun-servers.xml, you
also can use "?transport=tcp" and generate the username/password with
the following command:

secret="YOUR_COTURN_SHARED_SECRET" && time=$(date +%s) && expiry=8400 &&
username=$(( $time + $expiry )) && echo username:$username && echo
password : $(echo -n $username | openssl dgst -binary -sha1 -hmac
$secret | openssl base64)

If you get an "relay answer" your TURN is working fine.

Maybe this is helping you.

Pypo

BTW: Is your coturn behind a NAT itself?


Am 07.02.2021 um 09:46 schrieb Marco Unso:
> Hi,
>
> sorry, but the error is still the same. The Coturn-Server listen for
> STUN on UDP and TCP 80, but the Client try only to connect over UDP Port
> 80. I Think, the problem is the BBB-Config. Why I cannot add the
> parmeter " transport=tcp" for the STUN-Server? Only for Turn-Server the
> TCP-flag works fine.
>
> Cheers, Marco
>
> Marco Unso schrieb am Freitag, 29. Januar 2021 um 08:46:18 UTC+1:
>
> Verry strange...
>
> i change the turn conf, but the Client still try connect to UDP:80:
>
> listening-port=80
> tls-listening-port=443
>
> listening-ip=100.xx.xx.xx
> relay-ip=100.xx.xx.xx
>
> min-port=32769
> max-port=65535
> verbose
>
> fingerprint
> lt-cred-mech
> use-auth-secret
> static-auth-secret=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> realm=turn.xxx.de <http://turn.xxx.de>
>
> cert=/etc/coturn/certs/turn.xxx.de.fullchain.pem
> pkey=/etc/coturn/certs/turn.xxx.de.privkey.pem
> # From https://ssl-config.mozilla.org/
> <https://ssl-config.mozilla.org/> Intermediate, openssl 1.1.0g, 2020-01
> cipher-list="ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"
> dh-file=/etc/coturn/certs/dhparam4096.pem
>
> keep-address-family
> no-cli
> no-tlsv1
> no-tlsv1_1
>
> log-file=/var/log/coturn/coturn.log
>
> When I block the UDP-Port 80 in my Firewall outgoing i get error
> 1020 an see in my Firewall-Log, that the Client try to connect to
> the server over UDP:80.
>
> The inital-Connection to the turn-server come from the Client, and
> the client connect to the turn-Server, because I changed the
> Destination-Server in the file
> /usr/share/bbb-web/WEB-INF/classes/spring/turn-stun-servers.xml. So
> i think, that the bbb-Server must say the client, that he schould
> connect over TCP, instead of UDP? Am I wrong in my thinking?
>
> Ps.: sorry for my bad English ;-)
> distancelearning.cloud schrieb am Donnerstag, 28. Januar 2021 um
> 13:39:08 UTC+1:
>
> The docs, and config file example, and stun test all show 3478
> in the link  you provided.____
>
> __ __
>
> So what your saying is turn will also answer on 443 as well even
> though 3478 is configured?____
>
> __ __
>
> Let me build new one on 20.04 per bbb-install and compare
> against current running.____
>
> __ __
>
> Regards,____
>
> Stephen____
>
> __ __
>
> __ __
>
> __ __
>
> *From:* bigbluebu...@googlegroups.com
> <bigbluebu...@googlegroups.com> *On Behalf Of *basisbit
> *Sent:* Thursday, January 28, 2021 5:44 AM
> *To:* BigBlueButton-Setup <bigbluebu...@googlegroups.com>
> *Subject:* Re: [bigbluebutton-setup] STUN - TCP instead UDP
> Connection?____
>
> __ __
>
> @Stephen: STUN/TURN/TURNS on tcp/443 is the default suggested
> setup. No need to search any mailing list content.____
>
> @Marco: I'd suggest you to strictly follow the suggested
> configuration that is documented
> at https://docs.bigbluebutton.org/2.2/setup-turn-server.html#configure-coturn
> <https://docs.bigbluebutton.org/2.2/setup-turn-server.html#configure-coturn>
> , except comment out the `lt-cred-mech` line.____
>
> __ __
>
> distancelearning.cloud schrieb am Mittwoch, 27. Januar 2021 um
> 14:47:32 UTC+1:____
>
> Can you put the stun.turn server on edge of network with its
> own public interface, or run a cheap $40 vm in digital
> ocean?____
>
>  ____
>
> I have seen a few universities try to route everything
> through their campus firewall appliances, and all the media
> connections for video/audio/screenshare caused some major
> issues at scale.____
>
> Might work for a few users, but scale it to 1000, the
> appliance could not handle.____
>
>  ____
>
> The standard listening port number for a STUN server
> is *3478* for UDP and TCP, and *5349* for TLS,  assume you
> have to make some config changes in coturn config have not
> tried.____
>
>  ____
>
> There was a post earlier this year, where someone got both
> stun/turn on 443 and disabled encryption. Would have to
> search dev or setup group for it.____
>
>  ____
>
> Regards,____
>
> Stephen____
>
>  ____
>
>  ____
>
> *From:* bigbluebu...@googlegroups.com
> <bigbluebu...@googlegroups.com> *On Behalf Of *Marco Unso
> *Sent:* Wednesday, January 27, 2021 4:36 AM
> *To:* BigBlueButton-Setup <bigbluebu...@googlegroups.com>
> *Subject:* [bigbluebutton-setup] STUN - TCP instead UDP
> Connection?____
>
>  ____
> <http://turn.thillm.de:80>"/>                        -->
> Connection over UDP:80
>                 <constructor-arg index="0"
> value="stun:turn.thillm.de:80?transport=tcp
> <http://turn.thillm.de:80?transport=tcp>"/>        -->
> Connection also over UDP:80?!?
>
> The restrective firewall blocks the UDP port 80 outgoing
> (TCP 80, so HTTP is allowed through).
> Does anyone have a tip for me how to change the connection
> to the coturn server from UDP 80 to TCP 80?
>
> Thanks a lot for your effort!
>
> Greetings, Marco____
>
> --
> You received this message because you are subscribed to the
> Google Groups "BigBlueButton-Setup" group.
> To unsubscribe from this group and stop receiving emails
> from it, send an email to bigbluebutton-s...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/bigbluebutton-setup/23a8b0c1-b443-4d45-bbbd-8852a7150f85n%40googlegroups.com
> <https://groups.google.com/d/msgid/bigbluebutton-setup/23a8b0c1-b443-4d45-bbbd-8852a7150f85n%40googlegroups.com?utm_medium=email&utm_source=footer>.____
>
> --
> You received this message because you are subscribed to the
> Google Groups "BigBlueButton-Setup" group.
> To unsubscribe from this group and stop receiving emails from
> it, send an email to bigbluebutton-s...@googlegroups.com.
>
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/bigbluebutton-setup/983ef63d-cf75-4f8a-975b-a3bea89e7b9an%40googlegroups.com
> <https://groups.google.com/d/msgid/bigbluebutton-setup/983ef63d-cf75-4f8a-975b-a3bea89e7b9an%40googlegroups.com?utm_medium=email&utm_source=footer>.____
>
> --
> You received this message because you are subscribed to the Google
> Groups "BigBlueButton-Setup" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to bigbluebutton-s...@googlegroups.com
> <mailto:bigbluebutton-s...@googlegroups.com>.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/bigbluebutton-setup/4bab27c3-bbf9-4a92-a408-6a73e56e36adn%40googlegroups.com
> <https://groups.google.com/d/msgid/bigbluebutton-setup/4bab27c3-bbf9-4a92-a408-6a73e56e36adn%40googlegroups.com?utm_medium=email&utm_source=footer>.
Reply all
Reply to author
Forward
0 new messages