# coturn configuration for audio/video calls with Prosody
# From the homebrewserver.club guide:
#   https://homebrewserver.club/server-support-for-audio-video-calls.html
#
# Tested on 5 November 2026 in containers: coturn 4.18.0 (coturn/coturn
# Docker image) and coturn 4.6.1 (Debian 13 package) both start with this
# file and listen on port 3478. "prosodyctl check turn" from Prosody 13.0.7
# got a relay allocation from both, using the shared secret below.
#
# On Debian: sudo apt install coturn, then copy this file to
# /etc/turnserver.conf and restart coturn.
#
# Replace before use:
#   turn.example.org          -> the public DNS name of your TURN server
#   203.0.113.10              -> your public IPv4 address
#   192.168.1.10              -> the LAN address of the machine running coturn
#   static-auth-secret        -> a long random string, the same one as
#                                turn_external_secret in prosody.cfg.lua
# Generate a secret with:  openssl rand -hex 32

# ---- Listening ----

# STUN and TURN over UDP and TCP. 3478 is the standard port, and the
# port Prosody's mod_turn_external announces unless you set another one.
listening-port=3478

# No TURN-over-TLS listener in this setup. Calls are already encrypted
# end to end by the clients; TLS here only hides the TURN signalling.
no-tls

# ---- Addresses behind a home router ----

# The machine has a LAN address, but clients must be told the public one.
# Format: public-address/private-address. If your public IP changes, this
# line must be updated and coturn restarted.
external-ip=203.0.113.10/192.168.1.10

# Relay ports. Each relayed connection takes one port from this range.
# Forward the same range (UDP) from your router to this machine, with the
# same port numbers on both sides.
min-port=49160
max-port=49660

# ---- Authentication shared with Prosody ----

# Time-limited credentials (the "TURN REST API" scheme). Prosody creates
# them from the shared secret, clients use them, coturn checks them.
use-auth-secret
static-auth-secret=replace-with-a-long-random-secret
realm=turn.example.org

# Add a fingerprint to STUN messages; WebRTC clients expect it.
fingerprint

# ---- Do not let the relay reach your own network ----

# Anyone with valid credentials can ask coturn to send traffic to an
# address. Block private, loopback, link-local and CGNAT ranges so the
# relay cannot be used to reach devices on your LAN.
no-multicast-peers
denied-peer-ip=0.0.0.0-0.255.255.255
denied-peer-ip=10.0.0.0-10.255.255.255
denied-peer-ip=100.64.0.0-100.127.255.255
denied-peer-ip=127.0.0.0-127.255.255.255
denied-peer-ip=169.254.0.0-169.254.255.255
denied-peer-ip=172.16.0.0-172.31.255.255
denied-peer-ip=192.0.0.0-192.0.0.255
denied-peer-ip=192.168.0.0-192.168.255.255
denied-peer-ip=198.18.0.0-198.19.255.255
denied-peer-ip=240.0.0.0-255.255.255.255
denied-peer-ip=::1
denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff

# ---- Hardening and logging ----

# Do not reveal the coturn version in responses.
no-software-attribute
# The telnet admin console is not needed. coturn 4.6 needs this line to
# keep it off quietly. coturn 4.18 has the console off by default and logs
# "no-cli option is deprecated" for this line; you can delete it there.
no-cli
# Log to standard output. Under systemd this ends up in the journal
# (read it with: journalctl -u coturn).
log-file=stdout