# Coturn — Open Source TURN and STUN Server for WebRTC

> A free, open-source TURN and STUN server implementation that provides NAT traversal for WebRTC, VoIP, and real-time communication applications.

## Install

Save as a script file and run:

# Coturn — Open Source TURN and STUN Server for WebRTC

## Quick Use
```bash
# Install on Ubuntu/Debian
sudo apt install coturn
# Enable the service
sudo systemctl enable coturn
# Edit config
sudo nano /etc/turnserver.conf
# Start
sudo systemctl start coturn
```

## Introduction
Coturn is a mature, production-grade TURN and STUN server that enables NAT traversal for peer-to-peer communication. It is the most widely deployed open-source relay server for WebRTC, VoIP, and other real-time protocols, used by projects like Jitsi, Nextcloud Talk, and Matrix Synapse.

## What Coturn Does
- Implements full TURN (RFC 5766) and STUN (RFC 5389) protocols for NAT traversal
- Relays media traffic when direct peer-to-peer connections fail due to firewalls or symmetric NATs
- Supports TCP, UDP, TLS, and DTLS transport for secure relay connections
- Provides REST API-based credential generation for short-lived authentication tokens
- Handles thousands of concurrent media relay sessions with low latency overhead

## Architecture Overview
Coturn runs as a single-binary daemon that listens on configured ports for STUN binding requests and TURN allocation requests. When two peers behind NATs cannot establish a direct connection, Coturn allocates relay addresses and forwards encrypted media packets between them. It uses an event-driven I/O model with optional multi-threading to handle high connection counts efficiently.

## Self-Hosting & Configuration
- Deploy via package manager (`apt install coturn`) or build from source with `./configure && make`
- Configure realm, listening IP, external IP, and relay IP range in `/etc/turnserver.conf`
- Enable TLS by providing certificate and key paths for encrypted TURN connections
- Set up a user database (SQLite, PostgreSQL, MySQL, or Redis) for persistent credentials
- Use `--lt-cred-mech` for long-term credentials or REST API (`--use-auth-secret`) for ephemeral tokens

## Key Features
- Battle-tested in production at massive scale across thousands of deployments worldwide
- Supports both IPv4 and IPv6 with dual-stack relay capabilities
- Built-in rate limiting, bandwidth quotas, and per-user session caps for abuse prevention
- Prometheus-compatible metrics endpoint for monitoring relay health and usage
- Compatible with all major WebRTC stacks including libwebrtc, Pion, and mediasoup

## Comparison with Similar Tools
- **Pion TURN** — lightweight Go-based alternative; easier to embed but fewer enterprise features than Coturn
- **Twilio STUN/TURN** — managed cloud service; zero maintenance but costs scale with usage
- **Meetecho Janus** — full WebRTC gateway, not a standalone TURN server; complementary to Coturn
- **eturnal** — modern Erlang-based TURN server; simpler config but smaller community than Coturn

## FAQ
**Q: When do I need a TURN server?**
A: When peers are behind symmetric NATs or strict firewalls that block direct peer-to-peer connections. STUN alone works for simple NATs, but TURN relays traffic when STUN fails.

**Q: How much bandwidth does Coturn use?**
A: It relays only the traffic that cannot go peer-to-peer. Typically 10-20% of sessions need TURN relay; the rest connect directly via STUN.

**Q: Can Coturn scale horizontally?**
A: Yes. Run multiple Coturn instances behind a load balancer or DNS round-robin, sharing a common credential database like Redis or PostgreSQL.

**Q: Is Coturn secure?**
A: It supports TLS/DTLS encryption, short-lived REST API tokens, IP-based access control, and rate limiting to prevent unauthorized use and relay abuse.

## Sources
- https://github.com/coturn/coturn
- https://github.com/coturn/coturn/wiki

---
Source: https://tokrepo.com/en/workflows/asset-48ef30b2
Author: Script Depot