I'm trying to make coturn server work behind an AWS application load balancer. I'm using icetrickle to test it and the coturn seems that works as expected if I skip the load balancer and I hit directly the instance. The security group for the instance allows TCP and UDP traffic on every port (0 - 65535) for all the IPs (

This is the configuration that I have on the turn server:

vim /etc/default/coturn:


vim /etc/turnserver.conf:


then I start the server and I check it with icetrickle.

Icetrickle response - stun:{aws_public_ip}:3478

Time    Component   Type    Foundation  Protocol    Address Port    Priority
0.002   1   host    430735571   udp   64841   126 | 30 | 255
0.100   1   srflx   842163049   udp  64841   100 | 30 | 255
0.104   Done

turn server log - tail -f /var/log/turn_15892_:

3983: session 001000000000000146: TCP socket closed remotely
3983: session 001000000000000146: closed (2nd stage), user <> realm <realm> origin <>, local, remote, reason: TCP connection closed by client (callback)
3986: handle_udp_packet: New UDP endpoint: local addr, remote addr
3986: session 001000000000000147: realm <realm> user <>: incoming packet BINDING processed, success

Wireshark log

96848   2875.279343  STUN    62  Binding Request
96851   2875.373118   STUN    114 Binding Success Response XOR-MAPPED-ADDRESS: MAPPED-ADDRESS: RESPONSE-ORIGIN: {aws_public_ip}:3478

Then I've configured the application load balancer. It accepts traffic at port 3478 (HTTP protocol) and forwards the traffic to the instance at port 3478. Here are the results:

Icetrickle response - stun:{aws_lb_url}:3478

Time    Component   Type    Foundation  Protocol    Address Port    Priority
0.001   1   host    430735571   udp   54374   126 | 30 | 255
39.861  Done

turn server log - tail -f /var/log/turn_15892_:

No new logs (only healthchecks)

Wireshark log

110396  3769.417283    STUN    62  Binding Request
110403  3769.511074   ICMP    90  Destination unreachable (Port unreachable)
An array of similar logs as it retries

As I see it is trying to connect to random ports that are configurable and the default config can span from ports 49152 to 65535 which I suspect this is the issue because the only port that we forward the traffic from load balancer to the instance is on port 3478. I wonder if there coturn config should be finetuned now that the server is behind load balancer.

Any advice/help will be much appreciated.

2 Answers 2


You should forward coturn UDP and TCP ports, but I am not sure if Application can do this.

For me it is unclear according the following if it is possible to forward udp ports. https://aws.amazon.com/elasticloadbalancing/features/#Product_comparisons If I understand it correctly, it says that Application Loadbalancer is only for http/https..


As turnserver is configured on port 3478, please open security group on specific port 3478 for both tcp and udp and from source on elb and on instance as well.

In turnserver configuration,please mention external IP as AWS elb ip, and you should mention another local IP parameter,which should be servers private IP.

The random ports you have mentioned are not at all issue,they are used for udp connection, so no need to worry for it.

on elb please configure timeout of 3600.

Please let me know if this configuration works. If not I can help further.


  • should it be application load balancer or classic load balancer? Nov 7, 2018 at 21:55
  • Also, how can I find the ip of the load balancer. This potentially can change, right? Nov 7, 2018 at 22:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .