Workaround for Public Networks that block ports

cabada · November 25, 2023, 6:41pm

Public networks may block certain ports that are not within the “normally used” range of ports. Would this affect p2p connections? Since they cannot find a way to traverse NAT, due to these blocks.

Are there work arounds? I’ve noticed that I cannot use the streaming protocol in public libraries, airports, etc.

P.S. In my case I host STUN and TURN servers.

cabada · December 18, 2023, 7:14pm

Bumping this I still haven’t figure it out

augustblack · December 18, 2023, 11:39pm

Hi,

I’ve run into (archaic) university networks in Europe that block all ports except 80 and 443 by default.

If your TURN runs on a different port, it won’t work.

I’ve had some success multiplexing on port 443 using nginx where I run both a web server (reverse proxy to Janus) and the coturn TURN server on the same 443 port.

Here is my solution in a nutshell:

gist.github.com

https://gist.github.com/augustblack/e5b3135e84ad705d9f57465aeb127a52

nginx_coturn_multiplex_howto.md

In order to allow access to janus from behind strict networks (usually only allowing ports 80 and 443) we need to set up a TURN server for Janus.  Since Janus is static, our peer IP is also static.  We can set up our coturn server with basic long term password protected authentication and then only whitelist the Janus IP in the config.  This minimzes the complexity of setting up authentication between coturn and browser clients.  

In order to save cost, we also want to co-locate our janus and turn instance on the same host, but also on the same port 443.  We use 443 for janus to route /janus to the websocket connection. In order to do both TURN and web services on 443, we need to mulitplex the port and register two domains (eg webrtc.domain.com and turn.domain.com for web and turn, respectively).

We face some challenges in doing so, namely getting all the pieces together with TLS certs updating automatically.

You will need a server with docker, nginx, and certbot installed.

Create an nginx module called 70-turn-443.conf under /etc/nginx/modules-available/ and link to /etc/nginx/modules-enabled with:

This file has been truncated. show original

Topic		Replies	Views
Multiple Janus Instances Behind a NAT General	7	451	March 20, 2024
Using Overlay Network for UDP Traffic (AKA: Janus on Docker Swarm / Kubernetes) General	3	137	January 9, 2024
Multiple TURN servers for Janus instance General	3	161	October 20, 2023
Janus with Kubernetes: Demystifying the Myths General	0	345	March 20, 2024
Video Room is not generating local candidates General	4	184	April 24, 2023

Workaround for Public Networks that block ports

Related topics