How to configure / debug TURN using ejabberd?

user_13609950 0
Viewed 1207

I want to configure STUN/TURN in ejabberd in order to use WebRTC with 'Conversations' XMPP client.

Of course I read ejabberd STUN/TURN documentation and how to configure DNS SRV records. I also temporarily set authentication to anonymous. According to the gist A/V calls in Conversations I tested ICE / STUN / TURN with adb logcat and Trickle ICE.

My problem is: I do see "discovered ICE servers" and "STUN candidate" with type "srflx" (so I think STUN works correctly), but there is no "candidate" with type "relay", I just get type "host". Sometimes(!) I get the notification: "Not reachable?"

My config (ejabberd.yml):

'listen' is configured for udp and tcp, both with use_turn: true

'mod_stun_disco' contains four entries: type: stun and turn and transport: udp and tcp, all with identical IP and portnumber, matching the DNS SRV records.

listen:
  -
  port: 43210
  transport: udp
  module: ejabberd_stun
  use_turn: true
  ## The server's public IPv4 address:
  turn_ip: 123.123.123.123 # Servers real IPv4 IP
  auth_type: anonymous


mod_stun_disco:
  services:
    -
      host: 123.123.123.123 # Servers real IPv4 IP
      port: 43210
      type: turn
      transport: udp

So my last possible source of trouble is: I'm using a 'beginners friendly' managed hosting provider where I only have an unprivileged user account (Fedora). So I built and run ejabberd as a user and had to open several custom firewall ports: c2s, s2s_in, https, with and without TLS (and 'let's encrypt' certificate). But AFAICS everything works fine, everything except TURN. Of course I have no rights to run tcpdump to analyze TCP / UDP Traffic, but in ejabberd.log there I can find:

[info] @mod_stun_disco:handle_call:332 Offering STUN/TURN services to user@server.tld/Conversations.AbCD

And when I increase the loglevel to debug, with a real XMPP-Client there are 'Send XML on stream' entries with "reading that 'Relay candidate harvesting in WebRTC only works with credentials.', I changed auth: anonymous to user and provided the plaintext-credentials of a valid testuser to TrickleICE, and now I only see 'Not an ephemeral username' in my log.

So my question is: What to try next? Does anyone know whats going wrong? Or is there a way to dig deeper into debugging?

stun turn ejabberd
1 Answers

I have no knowledge of STUN/TURN, but asked this in the ejabberd chatroom and got two pointers:

Licaon_Kter said:

firewall for turn range 49xxx-65000

Holger said:

49152-65535 UDP must be accessible, plus 43210 UDP with his config.

And he should revert his fiddling: auth_type must be kept to the default (user) and he should just do mod_stun_disco: {}.

Regarding the UDP port range (49152-65535), he could configure a smaller range, e.g. turn_min_port: 60000 and turn_max_port: 60999. But he does need more than one or two ports.

If you have more doubts, you can join the ejabberd chatroom at ejabberd@conference.process-one.net

user_60393010
Related