For WebRTC to connect across restrictive NATs and firewalls, configure ICE with both STUN and TURN servers, exchange candidates through your application’s signaling channel, and test the resulting connection on the networks your users actually rely on. STUN helps peers try a direct route; TURN relays traffic when a direct route cannot be established.
How ICE, STUN and TURN work together
ICE (Interactive Connectivity Establishment) is the framework that gathers possible network paths and checks whether peers can communicate over them. STUN and TURN supply different kinds of information or paths that ICE can use; neither replaces the application’s signaling system.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Handbook of SDP for Multimedia Session Negotiations: SIP and WebRTC IP Telephony | $48.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
ICE gathers candidates and checks paths
Each peer gathers transport addresses called candidates, exchanges them with the other peer, and checks candidate pairs to find a working route. Candidates can be local interface addresses (host), mapped addresses learned through STUN (srflx), addresses discovered during connectivity checks (prflx), or addresses allocated through a TURN relay (relay). ICE selects a working path from the candidates it can check.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →STUN helps find a direct path
A STUN server tells an endpoint which public-facing address and port its NAT mapped for the connection. That information lets ICE create a server-reflexive candidate and try a direct peer-to-peer route. STUN does not carry the call’s media or data. If the NAT mappings or firewall rules prevent a direct route, using STUN alone does not make that route possible.
TURN relays traffic when needed
A client obtains a relayed transport address from a TURN server. If ICE selects that route, the server forwards traffic between the client and its peer. TURN can provide a working path when direct connectivity fails, but relaying uses server bandwidth and adds dependence on the relay service.
TURN can also be used deliberately so the remote peer sees the relay address rather than the client’s direct candidate addresses. This is not general anonymity: the TURN server still sees the client’s network connection to it.
Configure WebRTC and exchange candidates
Keep signaling separate from ICE
Your application must still deliver session descriptions (offers and answers) and ICE candidates between peers over a signaling mechanism of your choice. ICE checks connectivity; it does not transport its own signaling messages.
Free tools Windows power users keep installed
One-click scans. No signup required.
Supply ICE server configuration and credentials
Pass one or more STUN or TURN server entries in the iceServers configuration when creating an RTCPeerConnection. Each entry supplies a server URL or URLs; TURN entries also need a username and credential. Obtain credentials through an application-controlled mechanism appropriate to your deployment. Do not place permanent TURN server secrets in public client code.
const pc = new RTCPeerConnection({
iceServers: [
{ urls: "stun:stun.example.net:3478" },
{
urls: ["turn:turn.example.net:3478?transport=udp"],
username: turnUsername,
credential: turnCredential
}
]
});Replace the example host and credential variables with values for a TURN/STUN service you operate or use. Advertising a TURN URL in JavaScript does not start the server, open its listener ports, or make its relay range reachable.
Gather candidates and deliver them to the other peer
Exchange gathered candidates through signaling. If your signaling implementation uses trickle ICE, deliver candidates as they arrive, and handle the end-of-candidates state correctly. A peer that receives session descriptions but not the required candidates may never test the available paths.
Choose the transport policy intentionally
For ordinary calls, leave the default ICE transport policy, all, so ICE can consider direct and relayed candidates. Set iceTransportPolicy: "relay" only when you intentionally want relay-only candidate use, such as verifying TURN operation or avoiding disclosure of direct candidate addresses to the remote peer. Relay-only mode makes successful calls depend on TURN availability and increases relayed traffic.
Test STUN and TURN candidate gathering
Use the WebRTC Trickle ICE sample
The official WebRTC Trickle ICE sample accepts ICE server details and displays candidates gathered by the browser. Run it from a representative client network and enter the same server configuration used by your application.
- An
srflxcandidate indicates successful STUN candidate gathering. - A
relaycandidate indicates successful TURN candidate gathering.
A gathering error is not always fatal. For example, the sample notes that an IPv6 DNS lookup failure need not prevent a successful IPv4 relay candidate from being gathered. Judge the result by the candidate types and network paths your deployment needs, not by whether every attempted lookup succeeds.
Follow gathering tests with a real connection
Candidate gathering shows that the browser could obtain a candidate; it does not prove that a complete call works well. Make a real peer connection from the networks that matter, then inspect the selected candidate pair and assess media quality. Include the network combinations associated with failures, such as carrier connections, VPNs, and corporate networks that restrict UDP.
Troubleshoot a missing relay candidate
If no relay candidate appears, check the full path from the browser to the TURN service and from the service to its public network:
- Verify the TURN URL. Check its scheme, hostname, port, and transport parameter against the service’s actual listener configuration.
- Check DNS and reachability. Confirm that the hostname resolves as intended from the affected client network and that the advertised listener is reachable there.
- Validate credentials. Confirm that the username and credential are current and accepted by the TURN service. Check the credential-provisioning path if credentials are temporary or rotated.
- Inspect server listeners and relay ports. Confirm that the service is listening on the configured client-facing ports and that its relay port range is configured and permitted.
- Check firewalls and network translation. Review host firewalls, cloud security groups, and any NAT mapping between the TURN server and the public network. A reachable listener alone does not guarantee that relayed traffic can pass.
- Repeat the test from the affected network. A candidate gathered on one network does not establish reachability from another network with different NAT or firewall behavior.
Plan for UDP restrictions, IPv6 and relay capacity
WebRTC transport requirements call for TURN support for endpoint-dependent NAT cases and require support for TURN over TCP and TURN over TLS over TCP for endpoints behind firewalls that block UDP. They also cover IPv6 TURN extensions for IPv4/IPv6 interoperation. Confirm that your service actually listens on and is reachable through the transports and address families it advertises; listing a URL in browser configuration is not sufficient.
Relayed sessions consume bandwidth at the TURN server. RFC 8656 says a TURN server typically needs a high-bandwidth Internet connection and advises using TURN only when a direct communication path cannot be found: RFC 8656. There is no reliable universal per-call bandwidth multiplier: demand depends on media bitrate, directionality, the share of sessions that use relays, protocol overhead, and the application mix. Measure relay use and bandwidth in your own deployment.
Choose managed TURN or operate your own
A managed service shifts much of the relay operation to a provider; self-hosting gives your team responsibility for deployment, security, scaling, and availability. Compare the options against the actual networks and regions your users need rather than choosing on name alone.
- Geographic placement and latency: can users reach a nearby relay, and does the service cover the regions where calls happen?
- Transport and address-family support: does it support UDP, TCP, TLS over TCP, and the IPv4/IPv6 combinations your clients need?
- Credentials: how are client credentials provisioned, scoped, and rotated without exposing permanent secrets?
- Capacity and cost: what relay bandwidth limits, egress charges, and scaling controls apply?
- Operations: what monitoring, reliability commitments, and support are available, and who responds to outages?
- Security responsibility: if self-hosting, can your team secure and maintain a publicly reachable relay?
coturn is a free, open-source STUN/TURN server project that documents Linux package and Docker installation paths. Installation commands, version support, listeners, relay ranges, and firewall rules depend on the current coturn release and host environment; follow the project’s current documentation and verify the network configuration for your deployment.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
