search

pion / turn

Pion TURN, an API for building TURN clients and servers
MIT License
1.87k stars 319 forks source link

Cannot seem to locally stup turnserver. #399

Closed pwninitd closed 4 months ago

pwninitd commented 4 months ago

I am very new to this sphere and I just wanted to apologies if I take too much of your guys is time and if this isn't the appropriate place to ask this question (if so please redirect me I will ask my question elsewhere), but for now I don't know where to turn to for questions.

I tried to setup the turn-server/log example on my local machine but with no success. When I try to authenticate using trickle ICE I cannot seem to get any results.

This is what I get on trickle ICE Screenshot from 2024-06-23 14-03-46

And this is the log I get from the turn server Screenshot from 2024-06-23 14-05-13

And I use this command to start it ./log -public-ip 127.0.0.1 -users "username=password" If anyone can help me out I will be very grateful

rg0now commented 4 months ago

The weird fact about the TURN protocol is that the first packet sent by the client to the server will by design fail with a TURN "unauthenticated" error: this is how the TURN server returns a nonce for the client, which is in turn the main protection in TURN against replay attacks. So the client sends a request without a nonce, the server replies with an error but includes the nonce in the response, and from this point the client should retry with a nonce, this is what's not happening here for some reason. My totally uneducated guess would be that the browser WebRTC protocol stack contains a limitation that it stops gathering relay candidates from local TURN servers, but this is just a totally arbitrary guess. Just deploy the TURN server to a public IP (or a Docker container) and it will just work.

TL;DR The TURN error is by design, and the reason for the weirdness is on the browser side but I don't know what.

pwninitd commented 4 months ago

I've read something about the authentication and I know that the first response is a 401, but what confused me is that there were multiple of them. Anyways thank you for your response, however I have one more question. Can you guide me to any resources for deploying a turn server on a docker container?

rg0now commented 4 months ago

what confused me is that there were multiple of them

This is because the browser retries several times.

Can you guide me to any resources for deploying a turn server on a docker container?

Here is a prefab Dockerfile for the "simple" TURN server example in pion/turn. There are also a bunch of complete TURN server images available at popular container image repositories.

Closing this for now. Feel free to reopen if you find out the reason why the ICE test fails.