TURN(1) TURN(1) (GENERAL INFORMATION) TURN TURN TURN . . docs/Build.md . : 1. turnserver: TURN. TURN Server bin/ . 2. turnadmin: TURN. README.turnadmin turnadmin . 3. turnutils_uclient. README.turnutils turnutils . 4. turnutils_peer. README.turnutils turnutils . 5. turnutils_stunclient. README.turnutils turnutils . 6. turnutils_rfc5769check. README.turnutils turnutils . "examples/scripts" . examples/ : $ cd examples $ ./scripts/secure_relay.sh SYSTEMD (SYSTEMD) systemd systemd . TURN (RUNNING THE TURN SERVER) coturn ( ) : $ turnserver -o . : turnserver . . : ( ): $ turnserver -L 12.34.56.78 "=" : $ turnserver --listening-ip=12.34.56.78 ( ) : $ turnserver -a : $ turnserver --lt-cred-mech (NAME) turnserver - TURN STUN (SYNOPSIS) $ turnserver [-n | -c ] [flags] [ --userdb= | --psql-userdb= | --mysql-userdb= | --mongo-userdb= | --redis-userdb= ] [-z | --no-auth | -a | --lt-cred-mech ] [options] $ turnserver -h (DESCRIPTION) Config file settings: -n . -c (: turnserver.conf). examples/etc/turnserver.conf . . : o o etc/ o etc/ o /etc/ o /usr/local/etc/ o /etc : -b, --db, --userdb SQLite (: /var/db/turndb /usr/local/var/db/turndb /var/lib/turn/turndb). -e, --psql-userdb, --sql-userdb PostgreSQL. (secret) TURN REST API . : "host= dbname= user= password= connect_timeout=" ( 8.x Postgres). : "postgresql://username:password@hostname:port/databasename" ( 9.x Postgres). docs/PostgreSQL.md . PostgreSQL http://www.PostgreSQL.org . -M, --mysql-userdb MySQL MariaDB. TURN REST API . : "host= dbname= user= password= connect_timeout= read_timeout=" docs/MySQL.md . MySQL http://www.mysql.org http://mariadb.org . (SSL): ca, capath, cert, key, cipher ( http://dev.mysql.com/doc/refman/5.1/en/ssl-options.html ). --secret-key-file AES MySQL . MySQL MySQL . : MySQL "mysql-userdb" ! ! -J, --mongo-userdb MongoDB. TURN REST API . : "mongodb://username:password@host:port/database?options" docs/Mongo.md . MongoDB http://docs.mongodb.org/manual . -N, --redis-userdb Redis. TURN REST API . : "ip= dbname= password= connect_timeout=" TURN hiredis_ssl TLS "tls=true" CA : "... tls=true ca=". TLS ( ca, capath, cert, clientkey, sni, verify) docs/Redis.md . docs/Redis.md . Redis http://redis.io . : -v, --verbose . -V, --Verbose . -o, --daemon ( ). --no-software-attribute . "--software-attribute" . --software-attribute SOFTWARE_ATTRIBUTE . . "--no-software-attribute false". -f, --fingerprint (fingerprint) TURN. TURN . --include-reason-string STUN/TURN. . . -a, --lt-cred-mech ( WebRTC ). -z, --no-auth . -a -A. . - . --use-auth-secret TURN REST API. WebRTC . "TURN Server REST API" TURN REST API . : usercombo -> "timestamp:username" turn user -> usercombo turn password -> base64(hmac(input_buffer = usercombo, key = shared-secret)). TURN . . . static-auth-secret turn_secret . --oauth oAuth STUN/TURN RFC 7635. --dh566 566 DH TLS. 2066 . --dh1066 1066 DH TLS. 2066 . --tlsv1 TLSv1 . --tlsv1_1 TLSv1.1 . --no-tlsv1_2 TLSv1.3/DTLSv1.2 . --no-udp UDP. --no-tcp TCP. --no-tls TLS. --no-dtls DTLS. --no-udp-relay UDP RFC 5766 TCP RFC 6062. --no-tcp-relay TCP RFC 6062 UDP RFC 5766. --no-stdout-log stdout. stdout . ( stdout ). --syslog (syslog) . --syslog-facility (facility) syslog syslog. '' . --simple-log PID . logrotate . --log-min-level . : debug ( ) info warning error ( ). . --new-log-timestamp ISO-8601 . --new-log-timestamp-format ( strftime(1)) --log-binding STUN. DoS . --secure-stun STUN. STUN . -S, --stun-only STUN TURN . TURN STUN . --no-stun TURN STUN . STUN TURN . --allow-loopback-peers (peers) (127.x.x.x ::1). ! cli-password . --no-multicast-peers (224.0.0.0 *::FFXX). --mobility ICE (MICE). --cli (CLI). . --cli-ip --cli-port . --no-cli CLI. CLI "cli" . --server-relay . . . IP . http://tools.ietf.org/search/rfc5766#section-17.2.3 . --udp-self-balance ( ) UDP ( ). ALTERNATE-SERVER . TURN 300 ALTERNATE-SERVER . --check-origin-consistency (origin) : ORIGIN ( ORIGIN ). --drop-invalid-packets . . --drop-invalid-packets-log . . --udp-recvmmsg UDP ()recvmmsg fan-in ( --multiplex-peer ). --udp-recvmmsg=false ( 0=) . --udp-recvmmsg-log recvmmsg . --udp-gso UDP-GSO (UDP_SEGMENT cmsg) . sendmmsg N . --multiplex-peer ( sendmmsg GSO ) --udp-gso . --multiplex-peer . () ( ). UDP ( IPv4 IPv6) TURN IP:port . rcvbuf UDP . sendmmsg --udp-recvmmsg ( ) recvmmsg . : EVEN-PORT 400 EVEN-PORT . docs/multiplex-peer.md . --multiplex-peer-port . UDP multiplex-peer (: 3480 1 65000). i +2i ( IPv4) +2i+1 ( IPv6) ..+7 . = relay_threads * 2. --respond-http-unsupported HTTP 400 HTTP HTTP . . --prometheus (Prometheus). . 9641 /metrics / (health check) . apt . --prometheus-username-labels . ( TURN REST API) . --prometheus-port (: 9641). --prometheus-address
(: any). --prometheus-path (: metrics/). --version . -h . : --stale-nonce[=] (nonce) ( ). 0 . --max-allocate-lifetime (allocation). . --channel-lifetime . . --permission-lifetime (permission). . . -d, --listening-device . ( . ). turnserver (root) . turnserver . -L, --listening-ip IP . : -L ip1 -L ip2 -L ip3 IP IPv4 IPv6 . IP IP IP . -p, --listening-port TURN UDP TCP (: 3478). : TLS DTLS "" TCP UDP - . --tls-listening-port TURN TLS DTLS (: 5349). : "" TCP UDP TLS DTLS - . TURN "" . ( "" "tls") RFC 5766 . TCP SSL 3 TLS 1.0 1.1 1.2 . UDP DTLS 1 . --alt-listening-port UDP TCP ( ) " " . STUN CHANGE_REQUEST - RFC 5780 RFC 3489 - NAT . TURN CHANGE_REQUEST IP (IPv4 IPv6) . CHANGE_REQUEST UDP "" . --alt-tls-listening-port TLS DTLS. ( ) " TLS " . --tcp-proxy-port TCP . . (https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) --aux-server STUN/TURN. TURN STUN . () : 1) STUN RFC 5780 ( / CHANGE REQUEST) . 2) ALTERNATIVE-SERVER . 1.2.3.4:5555 IPv4 [1:2::3:4]:5555 IPv6. aux-server . -i, --relay-device ( . ). -E, --relay-ip ( IP ). : -E ip1 -E ip2 -E ip3 IP IP IP . turnserver : IP IP TURN ( ). -X, --external-ip / TURN NAT . -X "ip -" IP IP . CHANGE_REQUEST . NAT IP '' . "external-ip" XOR-RELAYED-ADDRESS . IP '' NAT ( 12345 '' 12345 ). IP "X -" . STUN NAT CHANGE_REQUEST (RFC5780 RFC3489) TURN NAT . . -m, --relay-threads ( ). 0 ( ). ( ). ( 3.9) UDP - "m 0 -" "m 1 -" . --cpus . CPU . CPU cgroup . --min-port UDP . 49152 RFC 5766. --max-port UDP . 65535 RFC 5766. --sock-buf-size ( ). -u, --user username:key. . turnadmin . 0x . . TURN REST API . -r, --realm (realm) / TURN ( userdb). TURN REST API . -C, --rest-api-separator () / TURN REST API . : . -q, --user-quota : . . -Q, --total-quota : . . -s, --max-bps TURN ( ). ( ). . -B, --bps-capacity . TURN ( ). --static-auth-secret ( ) TURN REST API. turn turn_secret ( ) . . ( ""). --no-auth-pings ''. --no-dynamic-ip-list IP / . --no-dynamic-realms . --server-name oAuth. . --cert PEM. . --no-tls --no-dtls . turn_server_cert.pem . --pkey PEM. . --no-tls --no-dtls . turn_server_pkey.pem . --raw-public-keys (Raw public keys). / RFC-7250 . Coturn OpenSSL 3.2.1 . --pkey-pwd . --cipher-list OpenSSL TLS/DTLS. TLS/DTLS TLSv1.2/DTLSv1.2 "DEFAULT" TLSv1.3 . --CA-file CA OpenSSL. TURN SSL . CA . --ec-curve-name EC OpenSSL ( TLS DTLS). prime256v1 OpenSSL 1.0.2 . OpenSSL 1.0.2 . --dh-file DH TLS PEM. --dh566 --dh1066 DH . -l, --log-file . turnserver /var/log/turnserver /var/log /var/tmp /tmp . () ( ). . "stdout" "-" - . "syslog" (syslog) "--syslog" . SIGHUP turnserver . --alternate-server " " (redirection). UDP TCP [:] . ALTERNATE-SERVER 300 ALLOCATE . . ALTERNATE-SERVER RFC 5389 RFC 5766 . TURN . --alternate-server " " " " . 3478 UDP/TCP . (:) IPv6 . IPv6 : [2001:db8:85a3:8d3:1319:8a2e:370:7348]:3478 . . (round-robin) . . 4 25 ALLOCATE . TURN alternate-server "" . --tls-alternate-server TLS DTLS :. 5349 TLS/DTLS . . -O, --redis-statsdb Redis (: Redis ). . --redis-userdb Redis / SQLite MySQL MongoDB PostgreSQL . redis-userdb . --max-allocate-timeout . 60 . --drain-min-allocations ( SIGUSR1 ) . 0 ( ). --denied-peer-ip= --allowed-peer-ip= IP IP. IP . IP IP . TURN TURN ( TURN NAT ). IP "" "" . / ( /) : 1) 2) "" - 3) "" "" . --pidfile (PID). /var/run/turnserver.pid ( ) /var/tmp/turnserver.pid . --acme-redirect ACME/RFC8555 ( Let's Encrypt) HTTP GET '*(.)/acme-challenge/well-known./^' 1$ (.*) == 1$. . ( ) . --proc-user . turnserver . --proc-group . turnserver . -K, --keep-address-family --allocation-default-address-family ! TURN <=> TURN . !! 4.2 RFC6156 ( IPv4 ) !! -A --allocation-default-address-family= IPv4 . TURN TURN . . RFC IPv4 ! --cli-ip IP CLI. turnserver telnet IP CLI ( ) . 127.0.0.1 . CLI telnet putty ( telnet) . --cli-port CLI. 5766 . --cli-password CLI. ( ). ( -P turnadmin ). . --cli-max-output-sessions ps CLI. CLI . 256 . --web-admin Turn. . --web-admin-ip= IP Web-admin. 127.0.0.1 . --web-admin-port= Web-admin. 8080 . --web-admin-listen-on-workers web-admin STUN/TURN . ! ( ). --rfc5780 RFC5780 ( NAT). NAT . NAT . STUN . --no-rfc5780 . --rfc5780 . --stun-backward-compatibility MAPPED-ADDRESS STUN XOR-MAPPED-ADDRESS . XOR-MAPPED-ADDRESS . STUN . --rfc3489-compatibility . RFC 3489 ("STUN ") . RFC 5389 RFC 8489 . . RFC 3489 --stun-backward-compatibility . STUN --rfc3489-compatibility . --unauthorized-ratelimit UDP 401 Unauthorized . . . --unauthorized-ratelimit-rps= UDP 401 Unauthorized IP . 10 . --stateless-nonce 401/438 ( HMAC ) . UDP STUN . TURN . --stateless-nonce=false . --stateless-nonce-secret= ( --stateless-nonce). . NTP . ================================== (LOAD BALANCE AND PERFORMANCE TUNING) : https://github.com/coturn/coturn/wiki/turn_performance_and_load_balance =================================== WEBRTC (WEBRTC USAGE) WebRTC : 1) WebRTC -a ( --lt-cred-mech) . WebRTC . -a ( -r) . : ) (-u). ) (SQLite PostgreSQL MySQL MongoDB). turnadmin ( turnadmin ). . ) () / Redis . turndb/testredisdbsetup.sh . ) TURN REST API . () / . 2) WebRTC (fingerprinting -f) . 3) -v . 4) TURN NAT -X . 5) --min-port --max-port . =================================== TURN REST API (TURN REST API) WebRTC TURN . - TURN . . . . TURN REST API - TURN - . . REST API TURN . (LTCM) : http://tools.ietf.org/html/rfc5389#section-10.2 http://tools.ietf.org/html/rfc5389#section-15.4 : . ORIGIN (realm) . (nonce) TURN . LTCM REST API . TURN REST API . . WebRTC . . : temporary-username="timestamp" + ":" + "username" username timestamp 1970 - (NULL)time . HMAC-SHA1 HMAC : temporary-password = base64_encode(hmac-sha1(shared-secret, temporary-username)) TURN . WebRTC - TURN REST API . . . . Justin's Uberti TURN REST API "TURN REST API" TURN Server https://github.com/coturn/coturn . () . : o TURN TURN . ORIGIN . o TURN . o TURN 401 . ORIGIN . o 401 : . o : key = MD5(username ":" realm ":" SASLprep(password)) ( SASLprep : http://tools.ietf.org/html/rfc4013) o . (integrity) . 15.4 : http://tools.ietf.org/html/rfc5389#section-15.4 o (fingerprint) . 15.5 . WebRTC TURN . o TURN . o TURN . o TURN . o TURN . o TURN - . . 401 . TURN "--stale-nonce" : 438 . - . . ( ) . . ( ). TURN examples/scripts/restapi/shared_secret_maintainer.pl . . =================================== (DATABASES) turnserver : 1) -u --user . turnserver . 2) SQLite . SQLite /var/db/turndb /usr/local/var/db/turndb /var/lib/turn/turndb . 3) PostgreSQL turnserver PostgreSQL . turnserver ( ) turnserver . . (schema) schema.sql . "" "" turnadmin . . ( ). turndb/testsqldbsetup.sql . 4) MySQL . . . 5) Redis Redis - ( ) schema.userdb.redis . Redis "" ( ) - " " . turndb/testredisdbsetup.sh . 6) . ( max-bps user-quota total-quota). 7) MongoDB . 8) turnserver . ( WebRTC) . : 1) . --redis-statsdb . 2) --redis-statsdb . --redis-userdb . . . MySQL Redis . Redis . . . *= . "" - turnadmin . PostgreSQL MySQL SQL schema.sql . Redis - turnadmin ( turnadmin ). SQLite turnserver turnadmin . TURN SQLite (/var/db/turndb /usr/local/var/db/turndb /var/lib/turn/turndb ). ================================= (ALPN) ALPN "stun.turn" "stun.nat-discovery" OpenSSL 1.0.2 . ClientHello TLS/DTLS ALPN *.stun ALPN ( ServerHello) . *.stun ALPN ServerHello . ================================= (LIBRARIES) lib/ TURN . include/ . C++ TurnMsgLib.h . C++ stunclient.c . ================================= (DOCS) : $ man turnserver : $ man -M man turnserver . docs/html . PREFIX/share/doc/turnserver/html . ================================= (LOGS) TURN turn_.log : o /var/log o /log/ o /var/tmp o /tmp o ( ) . --log-file --syslog --no-stdout-log . ================================= HTTPS (HTTPS MANAGEMENT INTERFACE) turnserver HTTPS . turnserver HTTPS TURN/STUN . . HTTPS admin_user () . ( ) ( ) . . ================================= (TELNET CLI) turnserver CLI telnet . turnserver CLI telnet IP 127.0.0.1 5766 . turnserver ( --cli-ip --cli-port ). CLI telnet "help" . ================================= (CLUSTERS) TURN (cluster) . "even port" ( RTP/RTCP) IP TURN . RTP RTCP IP . ( ) . ================================= (FILES) /etc/turnserver.conf /var/db/turndb /usr/local/var/db/turndb /var/lib/turn/turndb /usr/local/etc/turnserver.conf ================================= (DIRECTORIES) /usr/local/share/turnserver /usr/local/share/doc/turnserver /usr/local/share/examples/turnserver ================================= (STANDARDS) STUN RFC 3489 STUN RFC 5389 TURN RFC 5766 TURN-TCP RFC 6062 TURN IPv6 RFC 6156 STUN/TURN RFC 5769 NAT STUN RFC 5780 ================================= (SEE ALSO) turnadmin, turnutils ====================================== (WEB RESOURCES) : https://github.com/coturn/coturn : https://github.com/coturn/coturn/wiki : https://groups.google.com/forum/?fromgroups=#!forum/turn-server-project-rfc5766-turn-server ====================================== (AUTHORS) AUTHORS.md coturn . 17 May 2026 TURN(1)