What Are STUN and TURN
The goal of VIP is to create real-time communication that is high quality and low latency between VIP panels that may (or may not) be behind restrictive firewall rules. To do this UDP connections are used.
UDP - Direct between source and target of media flow.
UDP - Indirect (relayed) between source and target of media flow.
Direct Connection Between Panels
To establish a UDP connection between two panels we need to be able to negotiate through a firewall. To do this a given panel must be able to target the other panel’s (public or not) IP address and a negotiated port. However, most PCs/browsers do not know their own public IP address.
STUN is a protocol for the discovery of a browser’s public IP address from behind a NAT. A STUN server allows an Internet connected device (PC, cell phone, tablet) to determine its own public-facing IP address. STUN uses UDP, and STUN servers typically listen for UDP requests on port 3478. For a client to use STUN, their network connection/firewall must allow UDP traffic.
STUN tells a panel its public IP so that panel can send its IP to the other panel(s). Assuming both clients can route to the other's discovered IP address, and port, directly, communication is established with direct UDP sockets. However, if firewall rules or network devices block direct connections than an indirect connection is made using a TURN server.
STUN: Session Traversal Utilities (for) NAT
Creates the direct UDP connection between two clients.
Indirect connections between panels
If a direct UDP connection panel to panel(s) is not possible due to firewall and other restrictions then a TURN server is automatically used. The TURN server provides a known, Internet, IP address and port(s). TURN can be thought of as extension of STUN. TURN servers also (usually) listen on port 3478. VIP panel control data and audio are both relayed through the TURN server when a direct connection between panels is not possible.
TURN: Traversal Using Relay (around) NAT
Used to create a relayed UDP or TCP connection between two panels.
Using STUN and TURN
STUN and TURN capabilities can be leased from commercial providers. The number and location of the servers can be local, regional or global depending on the user’s needs and budget. Each service can offer a different number of simultaneous connections and may use its own range of ports. Ports between 20000 and 60000 may be used. Each service will, in general, use a particular range of ports and the ports are assigned to each TURN request as it occurs and for the duration of the connection. STUN and TURN services are usually offered together and each service has their own internal method for securing access to their TURN servers so their resources cannot simply be used by anyone.
It is also possible to create STUN and TURN servers for your own use.
WEBRTC
WebRTC is the set of protocols used by Telos Alliance in panel to panel communication and control. WebRTC includes audio and control data and both audio and data are end to end encrypted.
From Wikipedia: WebRTC (Web Real-Time Communication) is a free and open-source project providing web browsers and mobile applications with real-time communication (RTC) via application programming interfaces (APIs). It allows audio and video communication to work inside web pages by allowing direct peer-to-peer communication, eliminating the need to install plugins or download native apps. Supported by Apple, Google, Microsoft, Mozilla, and Opera, WebRTC specifications have been published by the World Wide Web Consortium (W3C) and the Internet Engineering Task Force (IETF).
The WebRTC connections are enabled by STUN and TURN.
Low latency data exchange
As a side note it is worth mentioning that intercom communications need to be low latency for the users and the packets needsto be delivered end to end at low latency to maintain the timing that allows the audio work. Network security measures that attempt to examine every packet tend to break the low latency requirement for delivery of digital audio packets between panels.
coturn
coturn is an open source TURN server. It can run as a service is most Linux OS. When supported by a Linus OS it is usually downloaded from the OS specific software package download. coturn can also be run as a Docker container.
When run in a VIP, or other, server a set of variables controls is run at startup. An example is below.
--log-file=stdout --realm=$DomainName --server-name=$DomainName --fingerprint --external-ip=${VIPExternalIP:-$(detect-external-ip)}/$VIPInternalIP --relay-ip=${VIPExternalIP:-$(detect-external-ip)}/$VIPInternalIP --min-port=14000 --max-port=15000 --user=$TurnUsername:$TurnPassword --lt-cred-mech