TURN(1) TURN(1) (GENERAL INFORMATION) TURN Server TURN TURN . . docs/Build.md . (binary images) : 1. turnserver: TURN. TURN Server bin/ . 2. turnadmin: TURN. README.turnadmin turnadmin . 3. turnutils_uclient. README.turnutils turnutils . 4. turnutils_peer. README.turnutils turnutils . 5. turnutils_stunclient. README.turnutils turnutils . 6. turnutils_rfc5769check. README.turnutils turnutils . "examples/scripts" . examples/ : $ cd examples $ ./scripts/secure_relay.sh (SYSTEMD) systemd systemd . (RUNNING THE TURN SERVER) coturn (daemon) : $ turnserver -o . : turnserver . . : ( ): $ turnserver -L 12.34.56.78 "=" : $ turnserver --listening-ip=12.34.56.78 (flag) ( ) : $ turnserver -a : $ turnserver --lt-cred-mech ===================================== (NAME) turnserver - TURN. (SYNOPSIS) $ turnserver [-n | -c ] [flags] [ --userdb= | --psql-userdb= | --mysql-userdb= | --mongo-userdb= | --redis-userdb= ] [-z | --no-auth | -a | --lt-cred-mech ] [options] $ turnserver -h (DESCRIPTION) : -n . -c ( - turnserver.conf). examples/etc/turnserver.conf . . : o o etc/ o etc/ o /etc/ o /usr/local/etc/ o /etc : -b, --db, --userdb SQLite ( - /var/db/turndb /usr/local/var/db/turndb /var/lib/turn/turndb). -e, --psql-userdb, --sql-userdb PostgreSQL. (secret) TURN REST API . : "host= dbname= user= password= connect_timeout=" ( Postgres 8.x ). : "postgresql://username:password@hostname:port/databasename" ( Postgres 9.x ). docs/PostgreSQL.md . PostgreSQL http://www.PostgreSQL.org . -M, --mysql-userdb MySQL MariaDB. (secret) TURN REST API . : "host= dbname= user= password= connect_timeout= read_timeout=" docs/MySQL.md . MySQL http://www.mysql.org http://mariadb.org . (SSL): ca, capath, cert, key, cipher ( http://dev.mysql.com/doc/refman/5.1/en/ssl-options.html ). --secret-key-file aes MySQL . MySQL . MySQL . : MySQL "mysql-userdb" ! (cleartext) ! -J, --mongo-userdb MongoDB. (secret) TURN REST API . : "mongodb://username:password@host:port/database?options" docs/Mongo.md . MongoDB http://docs.mongodb.org/manual/ . -N, --redis-userdb Redis. (long-term credentials) (secret) TURN REST API . : "ip= dbname= password= connect_timeout=" TURN hiredis_ssl TLS "tls=true" CA : "... tls=true ca=". TLS ( ca capath cert clientkey sni verify) docs/Redis.md . docs/Redis.md . Redis http://redis.io . (Flags): -v, --verbose (Moderate verbose). -V, --Verbose . -o, --daemon (daemon). --no-software-attribute (DEPRECATED). "--software-attribute" . --software-attribute SOFTWARE_ATTRIBUTE . . "--no-software-attribute false" . -f, --fingerprint (fingerprints) TURN. TURN (per-server). --include-reason-string STUN/TURN. . . -a, --lt-cred-mech (long-term credentials) ( WebRTC ). -z, --no-auth . -a -A. . - . --use-auth-secret TURN REST API. WebRTC . "TURN Server REST API" TURN REST API . (timestamp) : usercombo -> "timestamp:username", turn user -> usercombo, turn password -> base64(hmac(input_buffer = usercombo, key = shared-secret)). TURN . . . static-auth-secret turn_secret . --oauth oAuth RFC 7635 STUN/TURN. --dh566 DH TLS. . --dh1066 DH TLS. . --tlsv1 TLSv1 . --tlsv1_1 TLSv1.1 . --no-tlsv1_2 TLSv1.3/DTLSv1.2 . --no-udp UDP. --no-tcp TCP. --no-tls TLS. --no-dtls DTLS. --no-udp-relay UDP RFC 5766 TCP RFC 6062. --no-tcp-relay TCP RFC 6062 UDP RFC 5766. --no-stdout-log stdout. stdout . ( stdout ). --syslog (syslog) . --syslog-facility syslog syslog. '' . --simple-log PID . logrotate . --log-min-level . : debug ( ) info warning error ( ). . --new-log-timestamp ISO-8601 . --new-log-timestamp-format ( strftime(1)) --log-binding (binding) STUN. DoS . --secure-stun STUN Binding. STUN Binding . -S, --stun-only STUN TURN . TURN STUN . --no-stun TURN STUN . STUN TURN . --allow-loopback-peers (127.x.x.x ::1). ! cli-password . --no-multicast-peers (224.0.0.0 *:FFXX). --mobility MICE) ICE). --cli CLI. . --cli-ip --cli-port . --no-cli CLI. CLI "cli" . --server-relay . . . IP . : http://tools.ietf.org/search/rfc5766#section-17.2.3 . --udp-self-balance ( ) UDP ( ). ALTERNATE-SERVER . TURN 300 ALTERNATE-SERVER . --check-origin-consistency (origin consistency) : ORIGIN ( ORIGIN ). --drop-invalid-packets . . --drop-invalid-packets-log . . --udp-recvmmsg UDP ()recvmmsg fan-in ( --multiplex-peer ). false=--udp-recvmmsg ( 0=) . --udp-recvmmsg-log recvmmsg . --udp-gso Linux UDP-GSO ( UDP_SEGMENT cmsg) . sendmmsg N . --multiplex-peer ( sendmmsg GSO ) --udp-gso (no-op) . --multiplex-peer . ( ). UDP ( IPv4 IPv6) TURN IP:port (demultiplex) . rcvbuf UDP . sendmmsg --udp-recvmmsg ( ) recvmmsg . : EVEN-PORT EVEN-PORT . / docs/multiplex-peer.md . --multiplex-peer-port . UDP multiplex-peer (: 3480 -). i +2i (IPv4) +2i+1 (IPv6) ..+7 . = relay_threads * 2. --respond-http-unsupported HTTP HTTP HTTP . . --prometheus . . 9641 metrics/ / (health check) . apt . --prometheus-username-labels . ( TURN REST API) . --prometheus-port (: 9641). --prometheus-address
(: any). --prometheus-path (: /metrics). --version . -h . (Options with values): --stale-nonce[=] (nonce) ( ). 0 . --max-allocate-lifetime (allocation). . --channel-lifetime (channel binding) . . --permission-lifetime (permission). . . -d, --listening-device (listener interface device). ( . ). turnserver root . turnserver root . -L, --listening-ip IP . : -L ip1 -L ip2 -L ip3 IP IP IPv4 IPv6 . IP() IP() IP() . -p, --listening-port TURN UDP TCP (: ). : TLS DTLS () TCP UDP <<>> - . --tls-listening-port TURN TLS DTLS (: ). : TCP UDP <<>> () TLS DTLS - . TURN << >> . ( <<>> <>) RFC 5766 . TCP SSL TLS 1.0 1.1 1.2 . UDP DTLS . --alt-listening-port UDP TCP ( ) << >> . STUN CHANGE_REQUEST - RFC 5780 RFC 3489 - NAT . TURN CHANGE_REQUEST IP (IPv4 IPv6) . CHANGE_REQUEST UDP <<>> . --alt-tls-listening-port TLS DTLS. ( ) << TLS >> . --tcp-proxy-port TCP . proxy . (https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) --aux-server STUN/TURN (Auxiliary STUN/TURN server). TURN STUN . () : 1) STUN RFC 5780 (CHANGE REQUEST). 2) ALTERNATIVE-SERVER . 1.2.3.4:5555 IPv4 [1:2::3:4]:5555 IPv6. aux-server . -i, --relay-device ( . ). -E, --relay-ip ( IP ). : -E ip1 -E ip2 -E ip3 IP() IP() IP() . IP turnserver : IP IP TURN ( ). -X, --external-ip / TURN NAT . -X "-X " IP IP . CHANGE_REQUEST . NAT IP <<>> . "external-ip" XOR-RELAYED-ADDRESS . IP <<>> NAT ( <<>> ). IP "-X " . NAT STUN CHANGE_REQUEST (RFC5780 RFC3489) TURN NAT . . -m, --relay-threads ( ). 0 ( ). ( ). ( 3.9) UDP - "-m 0" "-m 1" . --cpus CPU . CPU . CPU cgroup . --min-port UDP (relay endpoints). RFC 5766 49152 . --max-port UDP (relay endpoints). RFC 5766 65535 . --sock-buf-size ( ). -u, --user username:key. . turnadmin . 0x . (realm) . TURN REST API . -r, --realm (realm) / TURN ( userdb). TURN REST API . -C, --rest-api-separator () / TURN REST API. : . -q, --user-quota : . . -Q, --total-quota : . . -s, --max-bps TURN ( ). (suppress) ( ). . -B, --bps-capacity . TURN ( ). --static-auth-secret ( ) TURN REST API. turn turn_secret ( ) . . ( ""). --no-auth-pings <<>>. --no-dynamic-ip-list IP /. --no-dynamic-realms (realm). --server-name oAuth. (realm) . --cert PEM. . --no-tls --no-dtls . turn_server_cert.pem . --pkey PEM. . --no-tls --no-dtls . turn_server_pkey.pem . --raw-public-keys (Raw public keys). / RFC-7250 . Coturn OpenSSL 3.2.1 . --pkey-pwd . --cipher-list OpenSSL TLS/DTLS. TLS/DTLS TLSv1.2/DTLSv1.2 "DEFAULT" TLSv1.3 . --CA-file CA OpenSSL. TURN SSL . CA . --ec-curve-name EC OpenSSL ( TLS DTLS). OpenSSL 1.0.2 prime256v1 . OpenSSL 1.0.2+ . --dh-file DH TLS PEM . --dh566 --dh1066 DH . -l, --log-file (log file). turnserver /var/log/turnserver /var/log /var/tmp /tmp . () ( ). . "stdout" "-" - (stdout) . "syslog" (syslog) "--syslog" . SIGHUP turnserver . --alternate-server " " (redirection). UDP TCP [:] . ALTERNATE-SERVER ALLOCATE . (address family) . ALTERNATE-SERVER RFC 5389 RFC 5766 . TURN . --alternate-server " " " " (load-balancing) . (port) UDP/TCP . (:) IPv6 . IPv6 () : [2001:db8:85a3:8d3:1319:8a2e:370:7348]:3478 . . (round-robin) . . ALLOCATE . TURN alternate-server "" . --tls-alternate-server TLS DTLS :. TLS/DTLS . . -O, --redis-statsdb Redis ( - Redis ). . --redis-userdb Redis / SQLite MySQL MongoDB PostgreSQL . redis-userdb . --max-allocate-timeout . . --drain-min-allocations (drain mode SIGUSR1) . ( ). --denied-peer-ip= --allowed-peer-ip= IP IP. IP IP . IP IP . turn turn ( turn NAT ). IP "" "" . / ( /) : 1) 2) "" - 3) "" "" . --pidfile pid . /var/run/turnserver.pid ( /) /var/tmp/turnserver.pid . --acme-redirect ACME/RFC8555 ( Let's Encrypt) HTTP GET '^/.well-known/acme-challenge/(.*)' $1 $1 == (.*). (trailing slash) . ( ) . --proc-user . turnserver (user ID) . --proc-group . turnserver (group ID) . -K, --keep-address-family --allocation-default-address-family !! TURN <=> . !! . RFC6156 ( IPv4) !! -A --allocation-default-address-family= IPv4 TURN TURN . . RFC IPv4 ! --cli-ip IP CLI. turnserver telnet IP CLI ( ) . 127.0.0.1 . telnet putty ( telnet) CLI . --cli-port CLI. . --cli-password CLI. ( ). ( -P turnadmin ). ($) (escaped). --cli-max-output-sessions CLI ps. CLI . . --web-admin Turn Web-admin. . --web-admin-ip= IP Web-admin. 127.0.0.1 . --web-admin-port= - (web-admin). 8080 . --web-admin-listen-on-workers - STUN/TURN (workers) STUN/TURN. ! ( .) --rfc5780 RFC5780 ( NAT). NAT . NAT (attributes) (amplification attack) . (gain factor) (binding) STUN . --no-rfc5780 . --rfc5780 . --stun-backward-compatibility MAPPED-ADDRESS STUN XOR-MAPPED-ADDRESS . XOR-MAPPED-ADDRESS . STUN . --rfc3489-compatibility . RFC 3489 (<>>) (magic cookie) . RFC 5389 RFC 8489 . . RFC 3489 --stun-backward-compatibility . STUN --rfc3489-compatibility . --unauthorized-ratelimit 401 Unauthorized UDP . . . --unauthorized-ratelimit-rps= 401 Unauthorized UDP IP . 10 . --stateless-nonce (nonce) 401/438 ( HMAC ) . UDP STUN . TURN (Wire-compatible). --stateless-nonce=false . --stateless-nonce-secret= stateless-nonce ( --stateless-nonce). (load-balanced) . NTP . ================================== (LOAD BALANCE AND PERFORMANCE TUNING) : https://github.com/coturn/coturn/wiki/turn_performance_and_load_balance =================================== WEBRTC (WEBRTC USAGE) WebRTC : 1) WebRTC (long-term) -a ( --lt-cred-mech) . WebRTC . -a (realm) ( -r) . : ) (-u). ) (SQLite PostgreSQL MySQL MongoDB). turnadmin ( turnadmin ). . ) () / Redis Redis . Redis turndb/testredisdbsetup.sh . ) TURN REST API . () / Redis. 2) WebRTC (-f) . 3) -v . 4) TURN NAT -X . 5) --min-port --max-port . =================================== (TURN REST API) WebRTC TURN . - TURN . . . . TURN REST - TURN - . . REST API TURN . <<>> (LTCM) : http://tools.ietf.org/html/rfc5389#section-10.2 http://tools.ietf.org/html/rfc5389#section-15.4 : (username) (password). ORIGIN (realm) . nonce realm TURN . LTCM REST API . TURN REST API . . WebRTC . . : temporary-username="timestamp" + ":" + "username" username timestamp - time(NULL) . HMAC-SHA1 (shared secret) HMAC : temporary-password = base64_encode(hmac-sha1(shared-secret, temporary-username)) TURN . WebRTC - TURN REST API . (timestamp) . . . TURN REST API (Justin Uberti) <> TURN Server https://github.com/coturn/coturn/ . () <<>> . : o TURN TURN . ORIGIN . o TURN . o TURN nonce 401 nonce realm . ORIGIN realm . o 401 : nonce realm. o username realm password : key = MD5(username ":" realm ":" SASLprep(password)) (SASLprep is described here: http://tools.ietf.org/html/rfc4013) o username realm nonce . (integrity) . 15.4 : http://tools.ietf.org/html/rfc5389#section-15.4 o fingerprint . 15.5 . WebRTC (fingerprinted) TURN . o TURN username . o TURN nonce realm . o TURN . o TURN (integrity) . o TURN - . . realm nonce 401 . TURN "--stale-nonce" : nonce 438 nonce nonce . - . . ( ) . . ( ). TURN examples/scripts/restapi/shared_secret_maintainer.pl . nonce . =================================== (DATABASES) turnserver : 1) -u --user . turnserver . 2) SQLite . SQLite /var/db/turndb /usr/local/var/db/turndb /var/lib/turn/turndb . 3) turnserver PostgreSQL PostgreSQL . turnserver ( ) turnserver . . (schema) schema.sql . <<>> (keys) <<>> turnadmin . realm . realm realm ( ). turndb/testsqldbsetup.sql . 4) MySQL . . . 5) Redis Redis - ( ) schema.userdb.redis . Redis <<>> (open passwords) ( ) - << >> . turndb/testredisdbsetup.sh . 6) realm . realm realm (max-bps user-quota total-quota) . 7) MongoDB . 8) turnserver . ( WebRTC) . : 1) . --redis-statsdb . 2) --redis-statsdb . --redis-userdb . . . MySQL Redis . Redis . . . *= . <<>> - turnadmin . PostgreSQL MySQL SQL schema.sql . Redis - turnadmin ( turnadmin ). SQLite turnserver turnadmin . TURN SQLite (/var/db/turndb /usr/local/var/db/turndb /var/lib/turn/turndb ) . ================================= ALPN ( ) ALPN "stun.turn" "stun.nat-discovery" OpenSSL 1.0.2 . ClientHello TLS/DTLS ALPN *stun. ( ServerHello) ALPN . *stun. ALPN ServerHello . ================================= (LIBRARIES) lib/ TURN . include/ . C++ TurnMsgLib.h . C++ stunclient.c . ================================= (DOCS) : $ man turnserver : $ man -M man turnserver . docs/html . PREFIX/share/doc/turnserver/html . ================================= (LOGS) TURN turn_.log : o /var/log o /log/ o /var/tmp o /tmp o ( ) . --log-file --syslog --no-stdout-log . ================================= HTTPS (HTTPS MANAGEMENT INTERFACE) turnserver HTTPS . turnserver TURN/STUN HTTPS . . HTTPS admin_user () . (superuser) ( realm ) ( realm ). . ================================= (TELNET CLI) turnserver (CLI) . turnserver CLI 127.0.0.1 5766 . turnserver ( --cli-ip --cli-port ). telnet CLI "help" CLI . ================================= (CLUSTERS) TURN . << >> ( RTP/RTCP) IP TURN . RTP RTCP IP . ( ) . ================================= (FILES) /etc/turnserver.conf /var/db/turndb /usr/local/var/db/turndb /var/lib/turn/turndb /usr/local/etc/turnserver.conf ================================= (DIRECTORIES) /usr/local/share/turnserver /usr/local/share/doc/turnserver /usr/local/share/examples/turnserver ================================= (STANDARDS) STUN RFC 3489 STUN RFC 5389 TURN RFC 5766 (TURN RFC 5766) TURN-TCP RFC 6062 TURN IPv6 RFC 6156 STUN/TURN RFC 5769 STUN NAT RFC 5780 ================================= (SEE ALSO) turnadmin, turnutils ====================================== (WEB RESOURCES) : https://github.com/coturn/coturn/ : https://github.com/coturn/coturn/wiki : https://groups.google.com/forum/?fromgroups=#!forum/turn-server-project-rfc5766-turn-server ====================================== (AUTHORS) AUTHORS.md coturn . 17 May 2026 TURN(1)