1

I'm trying to make coturn server work behind an AWS application load balancer. I'm using icetrickle to test it and the coturn seems that works as expected if I skip the load balancer and I hit directly the instance. The security group for the instance allows TCP and UDP traffic on every port (0 - 65535) for all the IPs (0.0.0.0/0::/0)

This is the configuration that I have on the turn server:

vim /etc/default/coturn:

TURNSERVER_ENABLED=1

vim /etc/turnserver.conf:

external-ip={aws_public_ip}
fingerprint
user={turn_user}:{turn_password}
lt-cred-mech
realm=realm
simple-log

then I start the server and I check it with icetrickle.

Icetrickle response - stun:{aws_public_ip}:3478

Time    Component   Type    Foundation  Protocol    Address Port    Priority
0.002   1   host    430735571   udp 192.168.1.102   64841   126 | 30 | 255
0.100   1   srflx   842163049   udp 109.242.109.35  64841   100 | 30 | 255
0.104   Done
0.106

turn server log - tail -f /var/log/turn_15892_:

3983: session 001000000000000146: TCP socket closed remotely 172.31.18.64:4630
3983: session 001000000000000146: closed (2nd stage), user <> realm <realm> origin <>, local 172.31.13.20:3478, remote 172.31.18.64:4630, reason: TCP connection closed by client (callback)
3986: handle_udp_packet: New UDP endpoint: local addr 172.31.13.20:3478, remote addr 109.242.109.35:57844
3986: session 001000000000000147: realm <realm> user <>: incoming packet BINDING processed, success

Wireshark log

96848   2875.279343 192.168.1.102   3.8.87.160  STUN    62  Binding Request
96851   2875.373118 3.8.87.160  192.168.1.102   STUN    114 Binding Success Response XOR-MAPPED-ADDRESS: 109.242.109.35:57844 MAPPED-ADDRESS: 109.242.109.35:57844 RESPONSE-ORIGIN: {aws_public_ip}:3478

Then I've configured the application load balancer. It accepts traffic at port 3478 (HTTP protocol) and forwards the traffic to the instance at port 3478. Here are the results:

Icetrickle response - stun:{aws_lb_url}:3478

Time    Component   Type    Foundation  Protocol    Address Port    Priority
0.001   1   host    430735571   udp 192.168.1.102   54374   126 | 30 | 255
39.861  Done
39.864

turn server log - tail -f /var/log/turn_15892_:

No new logs (only healthchecks)

Wireshark log

110396  3769.417283 192.168.1.102   52.56.189.26    STUN    62  Binding Request
110403  3769.511074 52.56.189.26    192.168.1.102   ICMP    90  Destination unreachable (Port unreachable)
An array of similar logs as it retries

As I see it is trying to connect to random ports that are configurable and the default config can span from ports 49152 to 65535 which I suspect this is the issue because the only port that we forward the traffic from load balancer to the instance is on port 3478. I wonder if there coturn config should be finetuned now that the server is behind load balancer.

Any advice/help will be much appreciated.

2

You should forward coturn UDP and TCP ports, but I am not sure if Application can do this.

For me it is unclear according the following if it is possible to forward udp ports. https://aws.amazon.com/elasticloadbalancing/features/#Product_comparisons If I understand it correctly, it says that Application Loadbalancer is only for http/https..

0

As turnserver is configured on port 3478, please open security group on specific port 3478 for both tcp and udp and from source 0.0.0.0/0 on elb and on instance as well.

In turnserver configuration,please mention external IP as AWS elb ip, and you should mention another local IP parameter,which should be servers private IP.

The random ports you have mentioned are not at all issue,they are used for udp connection, so no need to worry for it.

on elb please configure timeout of 3600.

Please let me know if this configuration works. If not I can help further.

Thanks.

  • should it be application load balancer or classic load balancer? – stavros.zavrakas Nov 7 '18 at 21:55
  • Also, how can I find the ip of the load balancer. This potentially can change, right? – stavros.zavrakas Nov 7 '18 at 22:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.