Browsed by
Category: WebRTC

How to Install & Configure TURN Server (coTURN)

How to Install & Configure TURN Server (coTURN)

This blog page covers how to install and configure coTURN server for your SIP or WebRTC projects (like Jitsi Meet) to allow users behind restrictive firewalls or proxies to connect.

What is TURN?

TURN stands for Traversal Using Relays around NAT. Similar as STUN, it is a network protocol / packet format (IETF RFC 5766) used to assist in the discovery of paths between peers on the Internet. It differs from STUN in that it uses a public relay to transfer packets between peers. TURN is used to exchange media packets when no other option is available. So that it consumes server resources and has an increased latency due to the extra hop in peer to peer connection.

The time when you must use TURN is when one of the peers is behind a symmetric NAT and the other is behind either a symmetric NAT or port-restricted NAT. The frequency of cases where a relay is necessary is around %10 of the overall connections, since STUN is enough for most cases.

Install coTURN Server

Audio / Video based services requires a wide range of UDP ports to be available for WebRTC. In some network restricted sites, such as those behind NAT or a firewall that restricts outgoing UDP connections, users may be unable to make outgoing UDP connections to your media server.

TURN protocol is designed to allow UDP communication flows to bypass NAT or firewalls by forcing the client to connect to the TURN server, and then force TURN server to connect to the destination on their behalf.

Using a TURN server under your control improves the success of connections to your multimedia application and also improves user privacy, since it acts like a proxy so that peers will no longer be sending their IP address information to a public STUN server.

Required Hardware

TURN protocol is not really CPU or memory intensive. Additionally, since it’s only used during connection setup (for STUN) and as a fallback for users who would otherwise be unable to connect, the bandwidth requirements aren’t particularly high. For a moderate number of connections, a single small VPS configuration is usually enough. Here you can find my reccomendations to install coTURN:

  • At least two vCPUs
  • 4GB Memory.
  • 20GB HDD. SSD can be used, but not mandatory.
  • The most important thing is the networking performance.
    • Low jitter (less than 30ms)
    • Low latency (less than 150ms)
    • Enough bandwidth to handle relayed media streams in both directions.

Having the server behind NAT (like on Amazon EC2) is OK, but all incoming UDP and TCP connections on any port (TCP 80 & 443, UDP 3478, 10000-20000) must be forwarded to coTURN server and not firewalled.

Required Software

I recommend using a minimal server installation of Debian with netinst or Ubuntu. Since coTURN software uses port TCP 443, the server which coTURN will be installed cannot have any other web applications running.

coTURN is already available in the Debian and Ubuntu repositories and it can be installed with apt-get:

$ sudo apt-get update
$ sudo apt-get install coturn

Please note that coTURN will not start automatically until the configuration is finished. You can find the configuration tasks in below.

DNS Entry For coTURN

You need to setup a fully qualified domain name (FQDN) that resolves the external IP address of your coTURN server. You’ll use this domain name to generate a TLS certificate.

Generating TLS Certificates

You can use certbot to generate free TLS certificates from Let’s Encrypt. To setup certbot, enter the following commands on your coTURN server:

$ sudo add-apt-repository ppa:certbot/certbot
$ sudo apt-get update
$ sudo apt-get install certbot

Note: If you face with add-apt-repository command not found error, please use sudo apt-get install software-properties-common command to install the necessary packets.

You can then run a certbot command like the following to generate the certificate, replacing turn.fatiherikci.com with the domain name of your TURN server:

$ sudo certbot certonly --standalone --preferred-challenges http \
    --deploy-hook "systemctl restart coturn" \
    -d turn.fatiherikci.com

Current versions of the certbot command set up automatic renewal by default. Note that when certbot renews the certificate, it will restart coTURN service, so coTURN will start to use the updated certificate files. This will cause an interruption on any ongoing TURN connections. You may change the certbot renewal schedule or disable automatic renewal if you like.

Configure coTURN

coTURN configuration is stored in /etc/turnserver.conf file. There are a lot of options and all of them are documented in comments in that file. I include a sample configuration below with comments as the recommended settings, also with notes in places where customization is needed.

You can replace the contents /etc/turnserver.conf with the file below and make these changes:

  • Replace turn.fatiherikci.com with the hostname of your TURN server
  • Change the values in bold with your choices.

You can see an example config file below:

server-name=turn.fatiherikci.com
realm=turn.fatiherikci.com
cert=/etc/letsencrypt/live/turn.fatiherikci.com/cert.pem
pkey=/etc/letsencrypt/live/turn.fatiherikci.com/privkey.pem
fingerprint 
listening-ip=0.0.0.0 
external-ip= 1.2.3.4/192.168.0.1 #or just write the external ip 
listening-port=3478 
min-port=10000 
max-port=20000 
log-file=/var/log/turnserver.log 
verbose 
user=myusername:mypassword 
lt-cred-mech

You can now start the COTURN service with this command:

$ systemctl start coturn

Running coTURN as a Service

The Debian / Ubuntu package for coTURN requires that you edit a file to enable at startup. Edit /etc/default/coturn file and uncomment the following line:

TURNSERVER_ENABLED=1

That’s it! coTURN install is complete. Now you have an up and runnning TURN server!

Testing Your TURN Server

To test your coTURN server, you can use Trickle-Ice testing tool. Go to trickle-ice webpage and enter following:

STUN or TURN URI : turn:Your Public IP Address:3478
TURN username: Username
TURN password: Password

Then click Add Server button and then click Gather Candidates button. If everything works well, you should see Done as final result.

What Is WebRTC?

What Is WebRTC?

We’ve been hearing the name WebRTC a lot lately. In fact, WebRTC, which has been in use since 2011, is not a new technology but is a technology that provides simultaneous media communication (audio and video). The most important feature of WebRTC, which has many advantages, is that it can work directly on many popular browsers without requiring additional software.

WebRTC stands for Web Based Real Time Communication. Multimedia applications can be designed using HTML5 and Javascript APIs.

We can define the communication format used in WebRTC as peer-to-peer. This communication is directly between peers, so you don’t need any media servers. WebRTC is free and has a BSD license, so you can develop WebRTC applications for free. (For example, you can experience a video conference virtual room with WebRTC at this link)

WebRTC Supported Browsers

Nowadays, the following browsers support WebRTC:

  • PC & MAC
    • Microsoft Edge 12+
    • Google Chrome 28+
    • Mozilla Firefox 22+
    • Safari 11+
    • Opera 18+
    • Vivaldi 1.9+
  • Android
    • Google Chrome 28+
    • Mozilla Firefox 24+
    • Opera Mobile 12+
  • iOS
    • MobileSafari / WebKit (iOS 11+)
  • Chrome OS
  • Firefox OS
  • BlackBerry 10
  • Tizen 3.0

WebRTC Components

There are 3 main components in WebRTC:

1. MediaStream API

The MediaStream API provides user access to the camera, microphone or screen using javascript.

2. RTCPeerConnection API

The RTCPeerConnection API provides NAT traversal, codec processing, mutual SDP negotiation, media transmission, and secure connection functions between peers.

3. RTCDataChannel API

The RTCDataChannel API provides the functionality of establishing bidirectional data transfer channels between peers.

Establishing Peer-to-Peer Connection

Signaling is a process that forms the connection between peers. It can be achieved by WebSocket, XMPP, SIP or any other mechanism. WebRTC technology utilizes protocols such as RTP, STUN, SIP and ICE.

WebRTC Signaling Process

Session Description Protocol (SDP)

Also known as SDP, it is a protocol used to communicate media capabilities (voice codecs, IP and port information, etc.) between peers before establishing a connection and to meet each peer at a common point.

Interactive Connectivity Establishment (ICE)

ICE is a framework for the NAT traversal mechanism. ICE collects all available candidates (local IP addresses, STUN return IP addresses, and transmitted IP addresses – TURN). All collected addresses are then sent to remote peers via SDP.

STUN Server

The STUN server enables peers to find public IP addresses, the types of NAT they use, and the relationship between the Internet-side port information associated with the local port information specified by NAT.

TURN Server

When STUN usage is not possible, it is used to transmit media streams over a TURN server (you may think of it as a proxy).

WebRTC is not always peer-to-peer (P2P), but in multiple communication situations (eg video conferencing), different solutions are available. Let’s take a look at these.

Multi-Point Communication Types

1. Mesh

In the mesh network, all peers send their streams separately to other connected peers directly on the network.

All Peers Communicate With Each Other in Mesh Topology

Since this structure is completely distributed, there is no need to have any media servers in the center. The disadvantage of the mesh structure is the use of high bandwidth. In a multi-video call using a mesh structure, if each user generates a 1 Mbps stream, the amount of data sent and received per user will be 4 Mbps in each direction.

2. SFU

SFU stands for Selective Forwarding Unit. An SFU receives incoming media streams from all users and then decides which users to send to.

SFU Transfers Media To All Peers Separately

In this model, each user transmits their own generated media stream to the SFU server. The SFU server can send whoever wants the stream. In this way, bandwidth is used more effectively. Similar with the mesh example above, if each user generates a 1 Mbps stream, the total outgoing data amount per user will be 1 Mbps and the total incoming data amount will be a maximum of 4 Mbps.

3. MCU

MCU stands for Multipoint Conferencing Unit. An MCU receives incoming media streams from all users, decodes them, creates a new layout, and sends it to all users as a single stream.

MCU Combines Media of All Peers & Sends a Single Stream to Peers

The difference of this structure from SFU is that a single combined stream will be sent to each user and the total transmission and reception amount per user will be 1 Mbps in each direction. The disadvantage of this structure, as you can imagine, is the high cost of the MCU with a high processing power in the center.

Jabra Panacast Review

Jabra Panacast Review

Video conferencing is now a method of communication used in many organizations. Many vendors release many new technology products in their hardware and software portfolio. In this article, you can find a detailed review of Jabra Panacast, a 3-camera video conferencing product.

Panacast History

Panacast adventure begins in 2007 with the idea of ​​“synchronized camera array”. Stanford-based Aurangzeb Khan and his team formed Altia Systems to develop Panacast in 2011. The first prototype of Panacast was released in 2012 and followed by Panacast 2 at the beginning of 2015. Altia Systems made such a great developments in image processing area and their products are used in more than 1600 companies. In February 2019, Altia Systems was acquired by GN Group (Jabra) for 129 million USD and Panacast is added to Jabra product line. Now we are seeing Jabra as a player in the video products also.

Jabra Panacast Specifications

Here are some of the highlights of Jabra Panacast:

  • 3 pcs. 4K Resolution 13MP Camera
  • 2 Microphones
  • USB 3.0 Plug and Play
  • Windows, MacOS and Linux Compatible
  • 180 Degree Horizontal, 54 Degree Vertical Viewing Angle
  • Live HDR
  • Smart Zoom
  • Whiteboard

The Jabra Panacast is quite small in size despite what it can do. The device measures 10cm x 7cm and weighs 100 grams, smaller and lighter than the average smartphone. The box contents are also quite simple; device, USB cable, booklet and warranty certificate.

Panoramic Image – How?

Panacast uses three 13 MP resolution 4K video cameras to produce 180-degree images.

Panacast Combines 3 Videos From Cameras to Create a Panoramic Vision

Camera images are overlapped and combined by using a special image processing algorithm which runs on XILINX Artix-7 FPGA. The final image has a resolution of 3840×1080 pixels which covers a 180 degree vision. Since all this is done in less than 5 milliseconds, the user does not feel any delays during this process.

Panacast Combines Images from Cameras Through Special Algorithm (source: panacast.com)

A similar solution has already been made with Huawei 3-screen Telepresence products. By using 3 downward facing cameras and prisms, the images were superimposed to achieve a continuous image. I have to inform you that the list price of such a system is worth 300K USD. 🙂

Camera Cluster Used in Huawei Telepresence Products

The advantage of the 180-degree image is it can fit more people on a single screen. In addition, another advantage is it provides this wide angle in smaller rooms, preventing dead spaces in the meeting room. You can see what I mean better in the image below:

No Dead Spaces in Meeting Rooms with Jabra Panacast (source: intermedia-cs.co.uk)

Intelligent Zoom

Thanks to Jabra Panacast’s PC software (Panacast Vision), the camera can achieve intelligent zoom (ePTZ). This allows the camera to zoom in (or crop the image) to accommodate the speakers in front of the camera, and transmit the image as much as the people in the meeting room. This process is done dynamically according to the person entering and leaving the room to provide an optimized image.

You can see intelligent zoom feature in more detail in the following video:

Jabra Panacaast Intelligent Zoom

Whiteboard

Another innovative feature of Panacast is the whiteboard application. After you have marked the corners of your whiteboard in your meeting room with the Panacast Vision software, you can now transmit your content on the board properly. In the following video you can find out how to do this in detail:

Jabra Panacast Whiteboard Feature Allows You to Use Whiteboard in Meeting Rooms

Compatibility with Video Conferencing Systems

Since Panacast is a plug and play camera, it is compatible with most video conferencing software. You can use this product which is approved by Microsoft Teams and with many video conferencing software such as Cisco Webex, Zoom, Hangouts, Slack.

Jabra Panacast Price

You can find Jabra Panacast around 900 USD. Although it may seem high for a webcam at first, it can be a wise choice to add video conferencing to your meeting rooms when you consider what it can provide and it’s return on investment.