A coturn service can be running and still fail as a TURN server: clients may not reach its listener, fail to obtain a relay candidate, or obtain one that cannot carry media. The fix depends on which stage breaks. Check the listener and firewall path first, then authentication and allocation, then the relay address, port mapping, and peer path.
Diagnose the stage that fails
TURN has separate client-to-server and server-to-peer paths. A successful connection to the TURN listener does not prove that coturn can allocate a relay address or pass media between peers. Compare the client’s ICE errors, candidates, and selected candidate pair with coturn logs and the actual firewall and NAT rules. These symptoms narrow the search; none has only one possible cause.
As an Amazon Associate I earn from qualifying purchases.
- No response from the TURN server: start with the listener address, port, protocol, and network access.
- No relay candidate or inconsistent allocation: check credentials, authentication settings, requested transport, and relay-port access.
- A relay candidate appears, but media does not flow: check the advertised address, relay-port mapping, peer reachability, and application-side ICE selection.
When clients cannot reach the listener
Being active in a service manager only shows that the process is running. It does not show that a remote client can reach the configured listener through the server’s interface, host firewall, cloud firewall or security group, and any upstream router or NAT.
coturn’s documented defaults are UDP and TCP on port 3478, and TLS and DTLS on port 5349. These are defaults, not requirements: check your deployed configuration rather than assuming those ports are in use. The coturn configuration reference describes the listener options; the Matrix coturn guide also covers allowing the configured listener through network firewalls.
#1 Best Overall
- 𝗢𝗻𝗲 𝗦𝘄𝗶𝘁𝗰𝗵 𝗠𝗮𝗱𝗲 𝘁𝗼 𝗘𝘅𝗽𝗮𝗻𝗱 𝗡𝗲𝘁𝘄𝗼𝗿𝗸: 5× 10/100/1000Mbps RJ45 Ports supporting Auto Negotiation and Auto MDI/MDIX.
- 𝗚𝗶𝗴𝗮𝗯𝗶𝘁 𝘁𝗵𝗮𝘁 𝗦𝗮𝘃𝗲𝘀 𝗘𝗻𝗲𝗿𝗴𝘆: Latest innovative energy-efficient technology greatly expands your network capacity with much less power consumption and helps save money.
- 𝗥𝗲𝗹𝗶𝗮𝗯𝗹𝗲 𝗮𝗻𝗱 𝗤𝘂𝗶𝗲𝘁: IEEE 802.3X flow control provides reliable data transfer and Fanless design ensures quiet operation.
- 𝗣𝗹𝘂𝗴 𝗮𝗻𝗱 𝗣𝗹𝗮𝘆: Easy setup with no software installation or configuration needed.
- 𝗔𝗱𝘃𝗮𝗻𝗰𝗲𝗱 𝗦𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗙𝗲𝗮𝘁𝘂𝗿𝗲𝘀: Prioritize your traffic and guarantee high quality of video or voice data transmission with Port-based 802.1p/DSCP QoS and IGMP Snooping.
- Verify the configured
listening-port, protocol, andlistening-ip; confirm coturn is bound to an interface reachable by clients. - Allow the configured listener protocol and port in every applicable firewall or network ACL, including cloud and upstream rules.
- Confirm the client’s TURN URI requests a scheme and transport the server actually supports.
When a relay candidate is missing or allocation fails
After a client reaches the listener, coturn still has to authenticate it and allocate relay resources. A credential, realm, or shared-secret mismatch can prevent allocation. So can a requested transport the deployment does not provide or a blocked relay range.
coturn documents long-term credentials for WebRTC use. Its TURN REST-style temporary credential mode uses a timestamped username and an HMAC-derived password; the application and server must agree on the secret and credential scheme. Check the client’s ICE server URL and credentials against coturn’s authentication mode, realm, and secret. See the project’s authentication and server configuration documentation.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #2
- GIGABIT ETHERNET PORTS: Features 5 x 1.0Gbps Ethernet ports for high-speed connectivity. Auto-negotiating ports detect the optimal speed for connected devices and work with existing Cat5e or Cat6 Ethernet cables.
- PLUG-AND-PLAY UNMANAGED NETWORK SWITCH: Simple plug-and-play setup with no software to install or configuration required.
- FLEXIBLE MOUNTING OPTIONS: Compact metal design supports desktop or wall-mount placement for versatile installation.
- SILENT & ENERGY-EFFICIENT OPERATION: Fanless design ensures silent performance, while IEEE 802.3az Energy Efficient Ethernet reduces power consumption without compromising high-speed network performance.
- REGIONAL COMPATIBILITY: Made for use in U.S. & CA only
The documented default UDP relay allocation range is 49152–65535. Treat it as a default, not a statement about your configured range. Permit the deployed relay range in the host and provider firewalls, and check coturn logs for authentication or allocation failures.
Client-to-TURN transport and TURN-to-peer relay transport are distinct. A client may connect to TURN over TCP or TLS while the media relay path still depends on UDP. Nextcloud’s coturn guide explains this distinction and advises enabling both UDP and TCP client transports where possible for compatibility. In its documented WebRTC context, disabling UDP relay makes coturn unusable; a TCP or TLS listener alone is not a universal replacement for a usable media-relay path.
Rank #3
- GIGABIT ETHERNET PORTS: Features 8 x 1.0Gbps Ethernet ports for high-speed connectivity. Auto-negotiating ports detect the optimal speed for connected devices and work with existing Cat5e or Cat6 Ethernet cables.
- PLUG-AND-PLAY UNMANAGED NETWORK SWITCH: Simple plug-and-play setup with no software to install or configuration required.
- FLEXIBLE MOUNTING OPTIONS: Compact metal design supports desktop or wall-mount placement for versatile installation.
- SILENT & ENERGY-EFFICIENT OPERATION: Fanless design ensures silent performance, while IEEE 802.3az Energy Efficient Ethernet reduces power consumption without compromising high-speed network performance.
- REGIONAL COMPATIBILITY: Made for use in U.S. & CA only
When a relay candidate exists but media does not flow
A relay candidate can be allocated successfully yet advertise an address peers cannot reach. This commonly points to an incorrect public/private address mapping, missing relay-port forwarding, a blocked peer path, or ICE selecting a different candidate pair than expected.
For a coturn server behind NAT, configure external-ip so coturn returns the publicly reachable address in XOR-RELAYED-ADDRESS. The NAT must forward allocated relay ports directly while preserving the port number: if coturn allocates 12345, the corresponding external relay port must also be 12345. Check the coturn NAT mapping documentation and Matrix’s firewall and NAT guidance.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- 8 GIGABIT PORTS: Features 8 RJ45 ports supporting 10/100/1000 Mbps speeds, providing high-speed wired network connectivity for computers, printers, gaming consoles, and other Ethernet-enabled devices
- PLUG AND PLAY SETUP: No configuration required; simply connect the switch to your network devices and it is ready to use immediately, making network expansion quick and hassle-free
- FANLESS QUIET DESIGN: The fanless design ensures silent operation, making this switch suitable for noise-sensitive environments such as home offices, bedrooms, or conference rooms
- STURDY METAL CONSTRUCTION: Built with a durable metal housing and shielded ports that provide reliable performance, better heat dissipation, and protection against electromagnetic interference
- TRAFFIC OPTIMIZATION: Supports IEEE 802.3x flow control and advanced traffic optimization technology to reduce data bottlenecks and ensure smooth, efficient data transfer across your network
- Confirm that the advertised relay address is publicly reachable from the peer’s network.
- Open and forward the configured relay-port range, not just the listener port.
- For NAT forwarding, preserve the allocated relay port number end to end.
- Check that network policy permits the peer traffic your application needs, and verify which ICE candidate pair the client selected.
When failures happen only on restrictive networks
Some client networks restrict UDP or TCP, inspect traffic, or impose TLS requirements. Enabling another client-to-TURN transport may help a client reach the server, but it will not fix a wrong advertised relay address or a blocked relay range. TLS also does not guarantee connectivity through every firewall.
For TLS, configure valid certificate and private-key paths on coturn and use a matching turns: URI in the client or application. Matrix recommends first establishing a working basic setup before adding TLS; Nextcloud discusses TLS and transport choices in its coturn guide. Confirm that both the client and server support the selected scheme and transport.
Best Value
- 【One Switch Made to Expand Network】Features 5 RJ45 ports with 10/100/1000Mbps speeds, supporting Auto-Negotiation and Auto MDI/MDIX for hassle-free setup. Ideal for expanding your network, with 1 uplink (input) port and 4 output ports to split your Ethernet connection to multiple devices.
- 【Gigabit that Saves Energy】Latest innovative energy-efficient technology greatly expands your network capacity with much less power consumption and helps save money
- 【Reliable and Quiet】IEEE 802.3X flow control provides reliable data transfer and Fanless design ensures quiet operation
- 【Plug and Play】Easy setup with no software installation or configuration needed
- 【Ethernet Splitter】Connect to your router or modem for additional wired connections (laptop, gaming console, printer, etc)
Keep troubleshooting secure
If connectivity appears to improve after disabling authentication or allowing arbitrary peers, that is not a safe production fix. Restore the intended authentication controls and restrict which peer IP ranges the relay can contact. In particular, deny access to internal and private address ranges unless specific destinations are required. Matrix and Nextcloud document peer restrictions in their coturn setup guide and Nextcloud coturn guide.
coturn supports configurable log verbosity for diagnosing authentication and allocation problems. Use logs alongside client ICE events, but do not expose detailed internal reason strings publicly: the project warns that they may disclose information about the server. Refer to the coturn logging documentation.
Choose the fix based on the failure point
| What you observe | Where to investigate | What to correct |
|---|---|---|
| No listener response | Listener binding, protocol, host or provider firewall, upstream routing | Make the configured listener reachable through every network layer. |
| No relay candidate or allocation errors | Client credentials, coturn authentication and realm, requested transport, relay range | Align credentials and supported transports; permit the configured relay range. |
| Relay candidate but no media | Advertised public address, NAT mapping, relay-port forwarding, peer path, selected ICE pair | Correct the address and port mapping and permit the required peer traffic. |
| Failure limited to restrictive networks | Client transport policy, TLS configuration, network inspection, relay path | Enable supported client transports and configure matching TLS where needed; separately verify the relay path. |
The practical choice is to correct coturn’s settings, change the relevant network or firewall rules, or use a managed or third-party TURN service if operating the relay is not a fit. AWS lists self-hosted coturn on EC2/ECS, its managed Kinesis Video Streams TURN relay, and third-party TURN among options for its own WebRTC runtime; that is an AWS-specific set of options, not a general comparison of cost or quality. See AWS’s WebRTC documentation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
