Coturn docker on arm32 (Raspberry Pi) is failing due to port-range and TLS problem

user_16683369 0
Viewed 414

this is my first question here so hope I do everything correct.

I'm using Docker image 4.5.2-r3 (with 4.5.2-r2 it was the same) on arm32 (RPi4) with Raspbian/Debian Buster. I get quite some errors and all clients (inside and outside the servers network/my home network) are stucked in "connecting".

This is my turnserver.conf

use-auth-secret
static-auth-secret={hidden}
realm=turn.{address-hidden}

min-port=49152
max-port=49172
external-ip={hidden}

log-file=stdout
pidfile=/var/tmp/turnserver.pid
userdb=/var/tmp/turnserver.db

no-cli
cert={Path hidden}
pkey={Path hidden}
no-tlsv1
no-tlsv1_1

prod
no-tcp-relay

The server is behind a NAT, all ports are open in ufw and forwarded in the router. If I use credentials and test it with ICE Trickle it is working but when making calls I get this in the logs: (this is the actual order the errors are occuring, some of them a few times in a row)

create_relay_ioa_sockets: no available ports 3 incoming packet message processed, error 508: Cannot create socket TLS/TCP socket buffer operation error (callback) incoming packet message processed, error 401: Unauthorized incoming packet message processed, error 403: Forbidden IP

Any ideas? I'm stucked with this for days and am (google is) running out of ideas! Thanks in advance...

Edit: I used mtr and Trickle ICE and the ports are open and forwarded correctly. Is there maybe another/a better solution to check that?

coturn nat raspberry-pi docker port
1 Answers

Issue was solved via GitHub, thanks to pushytoxin!! Solution was to configure the udp portrange for the relay-ports coturn is using to be extended (to 49152-49272 so 100 ports more) and the TLS part due to a bug in Element mobile clients regarding "Lets encrypt"-cert-chains...

Step-by-step:

  1. in turnserver.conf set min-port=49152 max-port=49272. If it still gives the same error try extending the portrange even further
  2. open the extended portrange in your firewall and if necessary forward it in your router
  3. if your are using lets-encrypt: in your homeserver.yaml set the two entries (udp and tcp) under turn_uris: to turn: instead of turns: - see here
user_166833690
Related