Coturn — Open Source TURN and STUN Server for WebRTC

Introduction

Coturn is a mature, production-grade TURN and STUN server that enables NAT traversal for peer-to-peer communication. It is the most widely deployed open-source relay server for WebRTC, VoIP, and other real-time protocols, used by projects like Jitsi, Nextcloud Talk, and Matrix Synapse.

What Coturn Does

• Implements full TURN (RFC 5766) and STUN (RFC 5389) protocols for NAT traversal
• Relays media traffic when direct peer-to-peer connections fail due to firewalls or symmetric NATs
• Supports TCP, UDP, TLS, and DTLS transport for secure relay connections
• Provides REST API-based credential generation for short-lived authentication tokens
• Handles thousands of concurrent media relay sessions with low latency overhead

Architecture Overview

Coturn runs as a single-binary daemon that listens on configured ports for STUN binding requests and TURN allocation requests. When two peers behind NATs cannot establish a direct connection, Coturn allocates relay addresses and forwards encrypted media packets between them. It uses an event-driven I/O model with optional multi-threading to handle high connection counts efficiently.

Self-Hosting & Configuration

• Deploy via package manager (apt install coturn) or build from source with ./configure && make
• Configure realm, listening IP, external IP, and relay IP range in /etc/turnserver.conf
• Enable TLS by providing certificate and key paths for encrypted TURN connections
• Set up a user database (SQLite, PostgreSQL, MySQL, or Redis) for persistent credentials
• Use --lt-cred-mech for long-term credentials or REST API (--use-auth-secret) for ephemeral tokens

Key Features

• Battle-tested in production at massive scale across thousands of deployments worldwide
• Supports both IPv4 and IPv6 with dual-stack relay capabilities
• Built-in rate limiting, bandwidth quotas, and per-user session caps for abuse prevention
• Prometheus-compatible metrics endpoint for monitoring relay health and usage
• Compatible with all major WebRTC stacks including libwebrtc, Pion, and mediasoup

Comparison with Similar Tools

• Pion TURN — lightweight Go-based alternative; easier to embed but fewer enterprise features than Coturn
• Twilio STUN/TURN — managed cloud service; zero maintenance but costs scale with usage
• Meetecho Janus — full WebRTC gateway, not a standalone TURN server; complementary to Coturn
• eturnal — modern Erlang-based TURN server; simpler config but smaller community than Coturn

FAQ

Q: When do I need a TURN server? A: When peers are behind symmetric NATs or strict firewalls that block direct peer-to-peer connections. STUN alone works for simple NATs, but TURN relays traffic when STUN fails.

Q: How much bandwidth does Coturn use? A: It relays only the traffic that cannot go peer-to-peer. Typically 10-20% of sessions need TURN relay; the rest connect directly via STUN.

Q: Can Coturn scale horizontally? A: Yes. Run multiple Coturn instances behind a load balancer or DNS round-robin, sharing a common credential database like Redis or PostgreSQL.

Q: Is Coturn secure? A: It supports TLS/DTLS encryption, short-lived REST API tokens, IP-based access control, and rate limiting to prevent unauthorized use and relay abuse.

Sources

• https://github.com/coturn/coturn
• https://github.com/coturn/coturn/wiki