Re: Use ports 80 and 443 in TURN

[shakeeb]

Hi Robert,

To run on port 80, the correct command will be sudo turnserver -a -o -v -n  -p 80  -u councilbox:tkZVdkW8 -r "someRealm"

You have given -p 80  after -u  without specifying username and password, so it is not listening on port 80.

There is no special configuration required to run turnserver on port 80 or port 443. You need to ensure that no other service is running on those port( netstat -nap | grep 80) and they are not blocked by the firewall.

Thanks,

Shakeeb

On Tuesday, May 2, 2017 at 10:34:08 PM UTC+8, Robert Hole wrote:

Hi, I have a TURN server, which was launched successfully with the following command sudo turnserver -a -o -v -n -u councilbox:tkZVdkW8 -r "someRealm"

To verify that everything works correctly I use https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice/, and I see how to obtain the candidates of type relay that desire.

Instead, when I use the command sudo turnserver -a -o -v -n -u -p 80 councilbox:tkZVdkW8 -r "someRealm", which indicates the port 80, in this case I do not get the same response but one that I get a "Not reachable"

What can I do to properly enable port 80 and even 443?

Thanks.

[Robert Hole]

Thanks for the quick reply. I have also tried with that line and the same thing happens. Port 80 is not occupied by any other service and the firewall is not blocking it.

With  "netstat -tupln" it seems that everything is correct, but I still get the same in the trickle-ice page

Is the execution line totally correct? Can any other problem be happening?

[Robert Hole]

I add that this happens with any port that indicates, it only works with the default ports.

[shakeeb]

Can you use tcpdump on the server and verify if the request comes to the server when you are using port 80 or port 443. Please try for both TCP and UDP.

If no request comes to the server then the issue is not related to the server.

[Robert Hole]

I will indicate the steps taken:

1. Exec sudo turnserver -a -o -v -n  -u userbox:9GhKllOo -r "someRealm"

2. Exec tcpdump -i eth0 udp port 3478

3. In command line tcpdump -i eth0 udp port 3478

4. In https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice/ I add my turn server and click on the button "Gather candidates"

4. tcpdump receive 16 packets.

I repeat the same with:

1. sudo turnserver -a -o -v -n  -p 80  -u userbox:9GhKllOo -r "someRealm"
2. Exec tcpdump -i eth0 udp port 80

3. In command line tcpdump -i eth0 udp port 80
4. In https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice/ I add my turn server and click on the button "Gather candidates"

4. tcpdump receive 0 packets.

What happen?

[Bradley T. Hughes]

> On 3 May 2017, at 17:06, Robert Hole <rober...@gmail.com> wrote:
>
> I repeat the same with:
> 1. sudo turnserver -a -o -v -n -p 80 -u userbox:9GhKllOo -r "someRealm"
> 2. Exec tcpdump -i eth0 udp port 80
> 3. In command line tcpdump -i eth0 udp port 80
> 4. In https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice/ I add my turn server and click on the button "Gather candidates"

Did you specify the port, i.e. stun:your.server.domain:80?

> 4. tcpdump receive 0 packets.

--
Bradley T. Hughes
bradley...@appear.in

[Robert Hole]

No... and that was the problem. Apologies and thanks for the answers, it was difficult to see something so trivial for you.

[Bradley T. Hughes]

> On 4 May 2017, at 09:30, Robert Hole <rober...@gmail.com> wrote:
>
> No... and that was the problem. Apologies and thanks for the answers, it was difficult to see something so trivial for you.

I am glad it was an easy fix :)

[Robert Hole]

One more doubt. If I just want to run the turn on port 443 with https security and on no other port, how should I do it ?. I am currently able to run the turn on port 443 with --tls-listening-port, but it also listens to the default port 3478.

Also, how can I make sure that connections are actually made through secure https connection?

Thanks.

[shakeeb]

You need to disable udp and tcp . You can disable udp and tcp by adding  --no-udp  --no-tcp  in the command line while starting turnserver or uncommenting no-udp and no-tcp in the config file.

Thanks,

Shakeeb   

[Warren McDonald]

Another thing to do is try to avoid running the turnserver process as root. Normally you can't bind to ports under 1024 without being root, but if you run the following command, making sure the path to the turnserver binary is correct

setcap cap_net_bind_service=ep /usr/bin/turnserver

then you can use the recommended non privileged user for the process

Warren.