WebRTC ICE failing on Firefox 57 (64-bit Linux) when trying to connect via OpenVPN to LAN
2,392 views
Skip to first unread message
Mikael Nousiainen
unread,
Dec 12, 2017, 11:35:20 AM12/12/17
Delete
You do not have permission to delete messages in this group
Copy link
Report message
Show original message
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to mozilla-...@lists.mozilla.org
I have a working Janus WebRTC server setup running in my LAN (streaming only live Opus audio). With direct connections -- while connected to the LAN -- it works perfectly every time with Firefox, Chrome, Chromium and the mobile browsers.
However, when I connect to the LAN from the public Internet via OpenVPN, Firefox states that ICE fails and does not output any audio, but Chrome and Chromium (latest versions) _do work_ always.
I'm not using a STUN or TURN server, because WebRTC should work fine inside LAN.
Also, There are no firewalls on traffic restrictions in place inside my LAN or the connecting workstation.
Here are the about:webrtc SDP details from Firefox:
Here are the Firefox trickle candidates when connecting via VPN:
candidate:0 1 UDP 2122252543 192.168.43.135 39927 typ host
candidate:2 1 TCP 2105524479 192.168.43.135 9 typ host tcptype active
candidate:1 1 UDP 1686052863 85.76.X.X 4187 typ srflx raddr 192.168.43.135 rport 39927
192.168.43.135 is the address provided by mobile phone WiFi tethering network.
85.76.X.X is the public IP address of the phone (which shouldn't really be needed here, as traffic should flow through OpenVPN).
After the trickle candidates have been sent, Janus sends back response:
{
janus: "hangup"
reason: "ICE failed"
...
}
And Janus logs state the same:
[8217140053462936] ICE failed for component 1 in stream 1, but let's give it some time... (trickle received, answer received, alert not set)
For comparison, here are the offer and answer SDPs and the only trickle candidate from Chromium, where the WebRTC audio stream works:
You do not have permission to delete messages in this group
Copy link
Report message
Show original message
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to Mikael Nousiainen, mozilla-...@lists.mozilla.org
Hi Mikael,
Could you please send me a copy go the connection log at the bottom of the about:webrtc <about:webrtc> page.
Even better would be pcap trace file taken with tcpdump or wireshark of the problem.
You do not have permission to delete messages in this group
Copy link
Report message
Show original message
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to mozilla-...@lists.mozilla.org
Hi Nils,
Here are two versions of the WebRTC log -- one using the default Google STUN server and one without. Both end up with the same result, but I wanted to confirm that the default STUN server setup won't interfere here (although it won't help with private LAN addresses anyway).
I will post a packet capture file in a separate message.
Here's the log without the STUN server:
Exit UDP socket connected
UDP socket error:Internal error at /builddir/build/BUILD/firefox-57.0/dom/network/UDPSocketParent.cpp:283 this=0x7fd578d6a400
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
UDP socket error:Internal error at /builddir/build/BUILD/firefox-57.0/dom/network/UDPSocketParent.cpp:283 this=0x7fd56d57e000
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:173 function nr_socket_multi_tcp_create_stun_server_socket skipping UDP STUN server(addr:)
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:173 function nr_socket_multi_tcp_create_stun_server_socket skipping UDP STUN server(addr:)
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:173 function nr_socket_multi_tcp_create_stun_server_socket skipping UDP STUN server(addr:)
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:173 function nr_socket_multi_tcp_create_stun_server_socket skipping UDP STUN server(addr:)
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:173 function nr_socket_multi_tcp_create_stun_server_socket skipping UDP STUN server(addr:)
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:173 function nr_socket_multi_tcp_create_stun_server_socket skipping UDP STUN server(addr:)
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:173 function nr_socket_multi_tcp_create_stun_server_socket skipping UDP STUN server(addr:)
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:173 function nr_socket_multi_tcp_create_stun_server_socket skipping UDP STUN server(addr:)
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:173 function nr_socket_multi_tcp_create_stun_server_socket skipping UDP STUN server(addr:)
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:173 function nr_socket_multi_tcp_create_stun_server_socket skipping UDP STUN server(addr:)
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:173 function nr_socket_multi_tcp_create_stun_server_socket skipping UDP STUN server(addr:)
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:173 function nr_socket_multi_tcp_create_stun_server_socket skipping UDP STUN server(addr:)
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:173 function nr_socket_multi_tcp_create_stun_server_socket skipping UDP STUN server(addr:)
/builddir/build/BUILD/firefox-57.0/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
You do not have permission to delete messages in this group
Copy link
Report message
Show original message
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to mozilla-...@lists.mozilla.org
I did also test this setup with a private STUN+TURN server (coturn) and it started working. The ICE candidate was using the private IP addresses with UDP protocol. WebRTC ceased to work again immediately when I stopped using the STUN/TURN server, so it seems to help here.
Mikael Nousiainen
unread,
Dec 13, 2017, 3:15:44 AM12/13/17
Delete
You do not have permission to delete messages in this group
Copy link
Report message
Show original message
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to mozilla-...@lists.mozilla.org
I've made two gzipped packet capture files available here for 48 hours:
One of the includes setting up both sending and receiving stream (and it looks like setting up sending goes further?) and the other one contains an attempt to create receiving stream only. The data does include some unnecessary TLS-encrypted packets that contain signalling traffic with Janus server (I couldn't figure out how to filter it out now).
-Mikael
Lorenzo Miniero
unread,
Dec 13, 2017, 5:28:03 AM12/13/17
Delete
You do not have permission to delete messages in this group
Copy link
Report message
Show original message
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to mozilla-...@lists.mozilla.org
Since Janus was mentioned, I think this may also be related to another similar issue I was told about by some other Janus users. Apparently, the same ICE failure happens under some circumstances when using docker, IIRC when trying to talk to a colocated docker instance. I don't remember the exact details (I can look for them) but it was due to the "weird" NAT behaviour docker has when using its host networking, and so may be related to the VPN scenario described by Mikael. In that case too, though, Chrome was working while Firefox wasn't: my guess at the time was some different management of the ICE state machine and/or something related to prflx candidates, but I never got much into the details there.
Please let me know if there's any way I can help,
Lorenzo
r...@iblargz.com
unread,
Feb 25, 2018, 10:53:15 PM2/25/18
Delete
You do not have permission to delete messages in this group
Copy link
Report message
Show original message
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to mozilla-...@lists.mozilla.org
Having this issue as well, I'm not sure it's related to Janus or docker (tested w/ and without).
with google's stun server, my own stun servers, and turn servers.
Don't worry Lorenzo, it's short won't need to scroll 3-4 times :)
Here's the connection log:
---------------
Exit UDP socket connected
UDP socket error:Internal error at /builds/worker/workspace/build/src/dom/network/UDPSocketParent.cpp:283 this=0x1150f9000
/builds/worker/workspace/build/src/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:173 function nr_socket_multi_tcp_create_stun_server_socket skipping UDP STUN server(addr:)
/builds/worker/workspace/build/src/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
/builds/worker/workspace/build/src/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:173 function nr_socket_multi_tcp_create_stun_server_socket skipping UDP STUN server(addr:)
/builds/worker/workspace/build/src/media/mtransport/third_party/nICEr/src/net/nr_socket_multi_tcp.c:617 function nr_socket_multi_tcp_listen failed with error 3
I even see it happening on mixer.com but a single peerreflexive managed to establish.
Nils Ohlmeier
unread,
Feb 27, 2018, 12:55:20 PM2/27/18
Delete
You do not have permission to delete messages in this group
Copy link
Report message
Show original message
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to r...@iblargz.com, mozilla-...@lists.mozilla.org
Hi Rob,
Can you please describe in more detail you think is an/the issue here?
Because at the end of your mail I see a list of host candidate plus two server reflexive candidates. That matches exactly what I get on that page as well, and is exactly what I would expect to happen on a page which provides a STUN server.